New features and enhancements

FortiNDR detects anomalies using a variety of methods, such as FortiGuard feeds like IPS, botnet IP and DNS DB, as well as added features such as IOC campaign lookup, vulnerable protocols and weak ciphers detection. Apart from detecting protocols like FortiOS NGFW, FortiNDR also looks into the behavior of devices & users, such as FTP download, or SMB copy.

CLI

• The new diagnose debug icap command will display the most recent ICAP file events and related error messages from FortiNDR's ICAP Server.

• New CLI to export and import NDR DB, which is useful for hardware backup, restore and upgrade. New CLIS are:

  • execute backup system-db disk

  • execute restore system-db disk|ftp|scp|tftp

  Note export/import are only supported with same software version of FortiNDR.

For information see the FortiNDRCLI Reference Guide.

GUI

• Idle timeout can be set with the GUI.

API

• API JSON output now includes the virus family name. When submitting a file for inspection, the API output will include a virus family name, as well as the virus name (e.g., FormBook/Xloader as virus family name).