## Endpoint Protection Platform (EPP) - Endpoint security software installed on endpoints. - FortiClient, FortiXDR, FortiEDR. ![[Pasted image 20260721082511.png]] ## FortiClient Endpoint Management Server (EMS) - Centralized management of FortiClient endpoints. - Deploy FortiClient software. - Works with FortiClient Web Filter extension to filter traffic on Google Chromebooks. - Deployable either on-prem or Fortinet-hosted cloud. - Software inventory and vulnerability dashboard. - Windows AD integration - ZTNA device posture check. ### Components - FortiClient EMS - Linux-based model. - PostgreSQL is used. ## FortiClient ![[Pasted image 20260721083758.png]] - FortiClient provides Compliance, Protection, and Security Access. - FortiClient is agent for VPN, ZTNA, and Security Fabric Telemetry. - FortiClient agent can also provide support for FortiSASE, FortiPAM, and FortiMonitor. - FortiSASE license includes FortiClient. - FortiClient Single-Sign-On Mobility Agent (SSOMA) is a feature of FortiClient Endpoint Security. The agent automatically provides username and IP address information to the FortiAuthenticator device. - FortiClient only loads the elements needed to stay lightweight. - FortiClient integrates into the Fortinet security fabric for detection and prevention of threats. - Native endpoint visibility, compliance control, vulnerability management, and automation. - FortiOS and FortiAnalyzer leverage FortiClient telemetry to identify IOC. - Admins can investigate in real-time and create automations such as device isolation. - FortiClient ZTNA works with FortiOS to enable granular access whether the user is on-site or remote. - Tunnel is established from FortiClient to FortiOS ZTNA app gateway for user/device authentication. - FortiClient does continuous endpoint posture checks to enable ZTNA gateway to provide real-time access control. - FortiClient provides threat protection against exploits and malware provided by FortiGuard and FortiSandbox integration. ### Editions ![[Pasted image 20260721140801.png]] ### Fabric Agent - FortiClient must connect to EMS to activate it's license and become provisioned by the endpoint profile. - When FortiClient telemetry is connected to EMS, it collects hardware, software, OS, identification, and vulnerability information. - When FortiClient participates in a security fabric, the fabric uses the information to understand the endpoint. - After installation FortiClient launches and connects telemetry that created the deployment package. You can also manually enter the EMS IP address or invitation code. - FortiClient performs vulnerability scans, provide details, and recommend actions. - FortiClient communicates with FortiGuard labs for signature updates. - FortiClient can automatically patch some software, end users must patch other software manually. - Web filtering settings are pushed from the management device and are read-only on the FortiClient console. - Block, allow, warn, and monitor web traffic based on URL category or custom URL filters. ### Secure Remote Access - Define compliance verification rules on EMS based on - Certificates - domain - files present - OS versions - running processes - registry keys - EMS dynamically groups endpoints based on ZTNA tags. - FortiOS can use the dynamic groups from EMS to create dynamic firewall policies. - FortiClient supports IPsec and SSLVPN connections. - FortiClient EMS admins can provision client VPN connections in FortiClient profile, FortiClient EMS endpoint profile, or endpoint user can configure new connections on the FortiClient console. - 2FA can be configured with FortiToken for both VPN connection types. - Other FortiClient VPN features - Map or unmap network drives based on VPN connections. - Automatically establish connection once FortiClient is launched. - Configure FortiClient to connect before user login on Windows. - Redundant IPsec VPN and priority based SSLVPN are supported on FortiClient on Windows/MacOS. - SAML authentication for IPsec and SSLVPN connections. ### Endpoint Protection - Anti-virus protection - Anti-ransomware - Cloud based malware protection - anti-exploit - control for removable devices. -