The Host Timeline is specifically designed to provide a chronological, consolidated view of all significant events (processes, network, registry, file) for a specific endpoint over a selected time period. This offers the most comprehensive starting point for understanding the full scope of activity, unlike the other options which provide more limited or specific information.

The collector profile contains the critical configuration that tells the EDR agent where to send its data (the FortiAnalyzer/FortiManager IP/URL and the necessary VDOM and serial number). If this is missing or incorrect, the agent will have no destination for its telemetry, which is a common cause for a ‘silent’ agent post-deployment. Checking the service status is a good second step, but the profile assignment is foundational.

Isolating the host is the primary containment action. It immediately blocks the host’s network communications (except to designated management systems) to prevent lateral movement, command-and-control callback, or data exfiltration while allowing you to continue forensic investigation on the endpoint itself. The other actions are important but are secondary to containment.

Fortinet EDR Playbooks allow for the automation of incident response workflows. A Playbook can be configured to trigger automatically upon a specific detection (e.g., ‘CoinMiner’ malware family) and execute actions, such as adding the host’s IP to a Dynamic Address Group. This group can then be used by other systems (like a deployment server) to initiate the re-imaging process, ensuring a consistent, fast, and automated response per policy.

IOCs are typically atomic indicators (like a file hash, IP address, or domain name) used for direct matching. YARA rules are far more powerful and descriptive; they allow analysts to write logic-based patterns to identify malware families based on code strings, byte sequences, and other characteristics within files or memory, making them essential for detecting variants and novel threats.

The EDR Agent Events log is the dedicated audit trail for actions related to the EDR agent itself. It will record specific events like agent service stoppage, process termination, driver removal, or configuration changes, providing the crucial forensic details needed to understand the nature of the tampering attempt.

The MITRE ATT&CK framework provides a common taxonomy for adversary tactics and techniques. Mapping detections to it helps analysts quickly understand the stage of the attack chain (e.g., Execution), provides context for the attacker’s goals, and enables more effective threat hunting by allowing searches for related techniques across the environment.

Fortinet EDR allows you to create a custom IOC based on the file’s MD5/SHA256 hash. You can then launch an On-demand Scan (IOC Scan) targeting a host group or all endpoints. This will search for the presence of that exact file hash on disk, identifying dormant threats that evaded initial execution-based detection.

Capacity planning is critical. EDR generates verbose endpoint telemetry data. The number and type of endpoints directly impact the required disk space for retention and the CPU/RAM needed for analysis and reporting. Under-provisioning the FortiAnalyzer can lead to performance issues or data loss, making this a primary architectural consideration.

The Host Timeline is specifically designed to provide a chronological, consolidated view of all significant events (processes, network, registry, file) for a specific endpoint over a selected time period. This offers the most comprehensive starting point for understanding the full scope of activity, unlike the other options which provide more limited or specific information.0