Which security fabric component sends a notification io quarantine an endpoint after IOC detection "n the automation process?

In the Fortinet Security Fabric automation process, FortiAnalyzer detects an Indicator of Compromise (IOC) and can trigger an automation stitch. This stitch typically instructs FortiGate to take action. For endpoint quarantine, FortiGate sends a request to FortiClient EMS via the fabric connector. FortiClient EMS, as the central management platform for endpoints, then processes this request and sends the notification to the FortiClient agent to enforce the quarantine policy. Therefore, EMS is the component that directly manages and communicates the quarantine action to the endpoint.

A. FortiAnalyzer detects the IOC and triggers the automation stitch, but it does not directly send the quarantine notification to the endpoint.

B. FortiGate receives the trigger and can enforce a network-level ban, but for endpoint-level quarantine, it sends a request to EMS rather than directly notifying the client.

D. FortiClient is the endpoint agent that receives the quarantine command from EMS and applies it; it does not send the notification itself.

1. FortiClient EMS 7.4 Administration Guide, "Fabric integration", p. 161. "When FortiGate detects a threat on an endpoint, FortiGate can send a quarantine request to EMS. EMS quarantines the endpoint."

2. FortiOS 7.4 Administration Guide, "Security Fabric > Automation > Actions > FortiClient EMS Quarantine", p. 21. "Sends a request to the configured FortiClient EMS to quarantine the endpoint device."