Which information can FortiSIEM retrieve from FortiClient EMS through an API connection?

FortiSIEM’s built-in device pack for FortiClient EMS uses the EMS REST API (GET /api/v1/EMS/client) to pull a limited endpoint inventory: host identifiers, OS and FortiClient versions, logged-on user, security posture, EMS tags and ZTNA tags. The API response explicitly contains the field ztnaTags, which FortiSIEM stores and can use in correlation rules. The API does not deliver the complete list of installed host software, any license information for FortiSIEM itself, or user passwords/credentials—only the username string. Therefore, among the choices, only ZTNA tags are retrievable.

A. Host software versions – API returns only OS/FortiClient version, not the full “host software versions” inventory implied here.

B. FortiSIEM license – EMS API has no field related to FortiSIEM licensing.

C. Host login credentials – Only the current username is returned; passwords/credentials are never exposed.

1. Fortinet

“FortiSIEM External Systems Configuration Guide 7.0.0”

Section “FortiClient EMS (API)”

pp. 297-298: lists endpoint fields hostName

osVersion

clientVersion

tags

ztnaTags.

2. Fortinet

“FortiClient EMS REST API Reference 7.0.1”

§ 3.4 “GET /api/v1/EMS/client”

Table 3-2: response object includes ztnaTags

no software inventory or credential fields.

3. Fortinet

“FortiSIEM Administration Guide 7.1.0”

Appendix A “Supported Device Types”

entry “FortiClient EMS”: shows collected attributes include ZTNA tags and excludes license or credential data.