Quarantining an endpoint from FortiOS using EMS
The Security Fabric offers visibility of endpoints at various monitoring levels. When the Security Fabric includes the following network devices, you can configure the system to automatically quarantine an endpoint on which an Indicator of Compromise (IoC) is detected. The following network components are required:
- FortiClient EMS
You must connect FortiClient to both the EMS and FortiGate. The FortiGate and FortiClient must both be sending logs to the FortiAnalyzer. You must configure the EMS IP address on the FortiGate, as well as administrator login credentials.
This configuration functions as follows:
- FortiClient sends logs to the FortiAnalyzer.
- FortiAnalyzer discovers IoCs in the logs and notifies the FortiGate.
- FortiGate determines if the FortiClient is among its connected endpoints and if it has the login credentials for the EMS that the FortiClient is connected to. With this information, FortiGate sends a notification to EMS to quarantine the endpoint.
- EMS searches for the endpoint and sends a quarantine message to it.
- The endpoint receives the quarantine message and quarantines itself, blocking all network traffic. The endpoint notifies the FortiGate and EMS of the status change.
FortiClient (Linux) does not support this feature.
The following lists the prerequisites that must be met for FortiClient, EMS, and the FortiGate:
FortiClient must be installed on the endpoint and connected to both EMS and the FortiGate.
- A profile must be assigned to the endpoint. See Assigning profiles to Windows, macOS, and Linux endpoints.
- A gateway list using the FortiGate's IP address must be assigned to the endpoint. See Creating gateway lists and Assigning gateway lists to endpoints.
- Enable Remote HTTPS access. See Configuring Server settings.
Before automation can be triggered, you must configure the following:
- Automation objects
- Automation trigger
- Automation object
- Automation stitch
- EMS firewall address object
- Endpoint control FCT-EMS object
To create an automation trigger, enter the following commands in the CLI:
config system automation-trigger
set trigger-type event-based
set event-type ioc
set ioc-level high
To create an automation action, enter the following commands in the CLI:
config system automation-action
set action-type quarantine-forticlient
set minimum-interval 0
To create an automation stitch, enter the following commands in the CLI:
config system automation-stitch
set status enable
set trigger "trigger01"
set action "action01"
To create a firewall address object, enter the following commands in the CLI:
config firewall address
set type ipmask
set subnet <EMS_IP_address> 255.255.255.255
To create an endpoint control FCT-EMS object, enter the following commands in the CLI. In the below commands, <EMS_SERIAL_NUMBER> is the EMS serial number, <EMS_ADMIN> is the EMS administrator name, and <PASSWORD> is the EMS administrator's password.
config endpoint-control forticlient-ems
set address "EMS01"
set serial-number <EMS_SERIAL_NUMBER>
set rest-api-auth userpass
set https-port 443
set admin-username <EMS_ADMIN>
set admin-password <PASSWORD>
set admin-type Windows
Once prerequisites are met, you can trigger the automation process. The following procedure triggers the quarantine action on the endpoint at <endpoint_ip_address>:
diagnose endpoint forticlient-ems-rest-api queue-complete-calls Q-<endpoint_ip_address>
After this action, the endpoint is quarantined.
You can also remove an endpoint from quarantine using the following command:
diagnose endpoint forticlient-ems-rest-api queue-complete-calls U-<endpoint_ip_address>