This configuration functions as follows:
1. FortiClient sends logs to FortiGate.
2. FortiGate sends logs to FortiAnalyzer. FortiAnalyzer discovers IOCs in the logs.
3. When an IOC threat type is detected on FortiAnalyzer, a playbook is triggered. As per the playbook
configuration, FortiAnalyzer sends an API to FortiClient EMS to quarantine the endpoint.
4. FortiClient EMS searches for the endpoint and sends a quarantine message to it.
5. The endpoint receives the quarantine message and quarantines itself, blocking all network traffic.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
lil_pc1972
Highly Voted 1 year, 2 months agolucient
Most Recent 9 months, 4 weeks ago