What exactly is FortiCloud Threat Detection?
I'm getting different stories from different vendors, and FG support chat does not inspire confidence. The docs from 6.x jump right into FortiClient, and other sources claim it's based on analyzing network traffic "through the switch" (which could mean the switch is analyzing OR that FC is analyzing.)
- Does "FortiCloud Threat Detection" as advertised on the renewal page use FortiClient?
- If not, how exactly does it work?
- Does it only report, or will it also quarantine?
- If it does have a FortiClient component, what does it do? (I can't imagine trusting FC on a machine that's already compromised.)
- Do I have to enable cloud management, and if so, does that involve opening a port on the WAN interface?
Posted Jun 13, 2022, 11:34 PM UTC · edited
16
It’s a traffic analysis service, similar to FortiAnalyzer Indicators of Compromise. It analyzes traffic logs from the FortiGate, and rates them against known indicators of compromise. It’s a post infection detection service.
Does it run purely on the FC without requiring FortiClient? How similar is it to FortiAnalyzer?
Let’s take a step back, where are you seeing this information? The context in which you found it could be helpful in giving you the right answer.
Good question.
Log into FortiCloud.
Asset Management > Online Renew > check the box next to a FortiGate > click Renew > click the pencil icon.
You will see "Configure Renewal Support Package" with several options: UTP, Elite Bundle, FortiCare, Enterprise Bundle, SMB bundle, and Customize.
At the bottom, there's a checkbox that says "FortiCloud Threat Detection: 1 year".
Ah ha! That!
That is the IOC subscription for FortiGate Cloud. So instead of FortiAnalyzer, you would send your logs to FG Cloud, and this is the IOC subscription for that. It does require you have a premium FortiGate cloud subscription and not the free version.
No forticlient required here. This is purely based off of firewall log traffic.
Hope this clears things up :).