Features

Discover and Predict

FortiEDR delivers the most advanced automated attack surface policy control with vulnerability assessments and discovery that allows security teams to:

• Discover and control rogue devices (e.g., unprotected or unmanaged devices) and IoT devices
• Track applications and ratings § Discover and mitigate system and application vulnerabilities with virtual patching
• Reduce the attack surface with risk-based proactive policies

Prevent

FortiEDR uses a machine learning anti-malware engine to stop attacks before execution. This cross-OS NGAV capability is configurable and comes built into the single, lightweight agent, allowing users to assign anti-malware protection to any endpoint group without requiring additional installation.

• Enable machine learning, kernel-based NGAV
• Enrich findings with real-time threat intelligence feeds from a continuously updated cloud database
• Protect disconnected endpoints with offline protection
• Leverage application control to easily add allowed or blocked applications to pre-defined lists. This feature is useful for locking down sensitive systems like POS devices
• USB device control

Detect and Defuse

FortiEDR detects and defuses file-less malware and other advanced attacks in real time to protect data and prevent breaches. As soon as FortiEDR detects suspicious process flows and behaviors, it immediately defuses the potential threats by blocking outbound communications and access to the file system from those processes if and once requested. These steps prevent data exfiltration, command and control (C&C) communications, file tampering, and ransomware encryption. At the same time, the FortiEDR back end continues to gather additional evidence, enrich event data, and classify the incidents for a potential automated incident response playbook policy to activate.

FortiEDR surgically stops data breaches and ransomware damage in real time, automatically allowing business continuity even on already compromised devices.

• Leverage OS-centric detection, highly accurate in detecting stealthy infiltrated attacks, including memory based and “living off the land” attacks
• Stop breaches in real time and eliminate threat dwell time § Achieve analysis of entire log history
• Prevent ransomware encryption, and file/registry tempering
• Continuously validate the classification of threats
• Enhance signal-to-noise ratio and eliminate alert fatigue

Respond and Remediate

Orchestrate incident response operations using tailor-made playbooks with cross-environment insights. Streamline incident response and remediation processes. Manually or automatically roll back malicious changes done by already contained threats - on a single device or devices across the environment.

• Automate incident classification and enhance the signal to-alert ratio
• Recommends response actions to security analysts
• Standardize incident response procedures with playbook automation
• Optimize security resources by automating incident response actions such as removing files, terminating malicious processes, reversing persistent changes, notifying users, isolating applications and devices, and opening tickets
• Enable contextual-based incident response using incident classification and the subjects of the attacks, (e.g., endpoint groups)
• Gain full visibility of the attack chain and malicious changes with patented code tracing
• Automate cleanup and roll back malicious changes while preserving system uptime
• Get additional help with the optional managed detection and response (MDR) service

Investigate and Hunt

FortiEDR automatically enriches data with detailed information on malware both pre- and post-infection to conduct forensics on infiltrated endpoints. Its unique interface provides helpful guidance, best practices, and suggests the next logical steps for security analysts.