EMS Administration Guide

Introduction
- FortiClient EMS components
- Documentation
Getting started
- Getting started with managing Windows, macOS, and Linux endpoints
- Getting started with managing Chromebooks
Installation preparation
- System requirements
- License types
  - FortiClient EMS
  - Component applications
- Required services and ports
- Management capacity
- FortiClient Telemetry security features
- Server readiness checklist for installation
- Upgrading from an earlier FortiClient EMS version
- Install preparation for managing Chromebooks
Installation and licensing
- Downloading the installation file
- Installing FortiClient EMS
- Installing FortiClient EMS using the CLI
- Starting FortiClient EMS and logging in
- Configuring EMS after installation
- Licensing FortiClient EMS
- Specifying different ports
- Upgrading Microsoft SQL Server Express to Microsoft SQL Server Standard or Enterprise
- Uninstalling FortiClient EMS
- Installation and setup for managing Chromebooks
  - Google Admin Console setup
  - Service account credentials
    - Configuring default service account credentials
    - Configuring unique service account credentials
- Verifying ports and services and connection between EMS and FortiClient
GUI
- Banner
- Left pane
- Content pane
Dashboard
- Viewing the Status
- Viewing the Vulnerability Scan dashboard
- Viewing Chromebook Status
Endpoint management
- Windows, macOS, and Linux endpoints
- Group assignment rules
- Google Domains
Deployment & Installers
- Manage Deployment
- FortiClient Installer
Endpoint Policy & Components
- Manage Policies
- CA Certificates
- On-fabric Detection Rules
Chromebook Policy
Endpoint Profiles
- Editing a default profile
- Creating a profile to configure FortiClient
- Adding a new Chromebook profile
- Viewing profiles
- Managing profiles
- Profile Name
- Malware Protection
- Sandbox Detection
- Web Filter
  - Importing a Web Filter profile from FortiOS or FortiManager
  - Enabling and disabling Safe Search
- Application Firewall
- VPN
- Vulnerability Scan
- System Settings
  - Configuring identity compliance for endpoints
- XML Configuration
  - Importing a profile from an XML file
  - Creating a profile with XML
Zero Trust Tags
- Zero Trust Tagging Rules
- Zero Trust Tag Monitor
- FortiOS dynamic policies using EMS dynamic endpoint groups
- Fabric Device Monitor
Software Inventory
- Applications
- Hosts
Quarantine Management
- Files
- Allowlist
Administration
- Administrators
- Admin roles
- Configuring User Settings
- Fabric Devices
  - Configuring EMS to share tagging information with multiple FortiGates
- SAML SSO
- Licenses
- Log Viewer
- Marking all endpoints as uninstalled
System Settings
- Configuring EMS settings
  - Adding an SSL certificate to FortiClient EMS
  - Adding an SSL certificate to FortiClient EMS for Chromebook endpoints
- Configuring Logs settings
- Configuring FortiGuard Services settings
- Alerts
- Custom Messages
  - Customizing the endpoint quarantine message
  - Customizing Web Filter messages
- Feature Select
- Generating a QR code for centrally managing FortiClient (Android) and (iOS) endpoints
Multitenancy
- Enabling and configuring multitenancy
- Global and per-site configuration
- Left pane with multitenancy enabled
- Editing a site
- Adding a multitenancy administrator
- Logging into EMS with multitenancy enabled
Creating a support package
Migrating to another EMS instance
Appendix A - Examples
- Support banned word check in URL

Home FortiClient 6.4.7 EMS Administration Guide

6.4.7

Sandbox Detection

Enable Sandbox Detection. Some options only display if you enable Advanced view.

Some options on this tab are only available for configuration if your FortiClient EMS license includes the Sandbox Cloud feature. For example, if you have only applied the ZTNA license, the FortiSandbox Cloud options are unavailable. See Windows, macOS, and Linux endpoint licenses for details on which features each license type includes.

This feature does not rely on FortiClient real-time protection and can be used alongside other real-time antimalware applications such as Windows Defender. Files that these applications have quarantined cannot be sent to FortiSandbox.

Configure the following options:

Options	Description
Sandbox Detection	Enable Sandbox Detection. Enable or disable the eye icon to show or hide this feature from the end user in FortiClient.
Server
FortiSandbox	Select Appliance to configure connection to an on-premise FortiSandbox appliance or Cloud to configure connection to FortiSandbox Cloud. FortiSandbox Cloud offers a more affordable alternative to a FortiSandbox appliance, since it is a cloud service that you do not need to host on-site. However, FortiSandbox Cloud does not offer the full range of features that a FortiSandbox appliance offers. See FortiSandbox Cloud documentation.
IP address/Hostname	Enter the FortiSandbox's IP address or hostname. Click Test Connection to ensure that EMS can communicate with FortiSandbox. This option is only available for a FortiSandbox appliance.
Username	Optional. Enter the FortiSandbox username. This option is only available for a FortiSandbox appliance. When using a FortiSandbox appliance, the username is necessary to view detailed FortiSandbox reports on the Sandbox Events tab. See Viewing Sandbox event details.
Password	Optional. Enter the FortiSandbox password. This option is only available for a FortiSandbox appliance. When using a FortiSandbox appliance, the password is necessary to view detailed FortiSandbox reports on the Sandbox Events tab. See Viewing Sandbox event details.
Region	FortiSandbox Cloud region. See Configuring FortiGuard Services settings.
Time Zone	FortiSandbox Cloud time zone. See Configuring FortiGuard Services settings.
License Status	Displays the Sandbox Cloud license status. Using FortiSandbox Cloud requires an additional license. See FortiClient EMS.
Inspection Mode	Select one of the following: None: FortiClient does not send any files to FortiSandbox for inspection. High-Risk Files: FortiClient inspects all supported high-risk files and sends to FortiSandbox as appropriate. All Supported Extensions: FortiClient inspects all supported file extensions and sends to FortiSandbox as appropriate. This option is only available for a FortiSandbox appliance.
Excluded File Extensions	Select a file extension to exclude from FortiSandbox scanning. You can select multiple file extensions.
Wait for FortiSandbox Results before Allowing File Access	Have the endpoint user wait for FortiSandbox scanning results before being allowed access to files. Set the timeout in seconds.
Deny Access to File When There Is No Sandbox Result	Deny access to downloaded files if there is no FortiSandbox result. This may happen if FortiSandbox is offline.
File Submission Options
All Files Executed from Removable Media	Submit all files executed on removable media, such as USB drives, to FortiSandbox for analysis.
All Files Executed from Mapped Network Drives	Submit all files executed from mapped network drives.
All Web Downloads	Submit all web downloads.
All Email Downloads	Submit all email downloads.
Remediation Actions
Action	Choose Quarantine or Alert & Notify for infected files. The user can access the file depending on Wait for FortiSandbox Results before Allowing File Access and Deny Access to File When There Is No Sandbox Result configuration. Whether FortiClient quarantines the file depends on if FortiSandbox reports the file as malicious and the FortiSandbox Detection Verdict Level setting.
Exceptions
Exclude Files from Trusted Sources	Exclude files signed by trusted sources from FortiSandbox submission. Following is a list of sources trusted by FortiSandbox: Microsoft Fortinet Mozilla Windows Google Skype Apple Yahoo! Intel
Exclude Specified Folders/Files	Exclude specified folders/files from FortiSandbox submission. You must also create the exclusion list.
Inclusions
Include Specified Folders/Files	Include specified folders/files in FortiSandbox submission. You must also create the inclusion list.
Other
Hide Sandbox Scan from Windows Explorer's Context Menu	Hide Sandbox scan option from Windows Explorer's right-click context menu.
Notification Type	Select the desired notification type to display to end users when FortiClient Cloud Sandbox detects an infected file: Lite: Displays notification balloon when FortiSandbox detects malware in a submission. Full: Displays a popup for all FortiSandbox file submissions. None: Does not display any notification for FortiSandbox file submissions, malware detection, or quarantine.

In addition to the configuration above, you must also configure the connection to EMS on the FortiSandbox. In FortiSandbox, go to Scan Input > Devices, and search for and authorize EMS using its serial number. You can find the EMS serial number on the System Information widget on the Dashboard.