A collector attempts to access a known malicious website. FortiEDR is configured for eXtended detection with FortiAnalyzer. What two roles does…

In the FortiEDR architecture, Fortinet Cloud Services (FCS) acts as the cloud-based threat intelligence and analytics backend. When a collector intercepts a potentially malicious event, the metadata is forwarded through the Core and Central Manager to FCS. FCS performs two primary roles in this process: it correlates and analyzes the collected event logs using cloud-based machine learning and threat intelligence, and it definitively identifies if a malicious event has taken place, subsequently reporting the detection incident back to the Central Manager. The Central Manager then handles forwarding these logs to FortiAnalyzer for eXtended detection (XDR).

A: The FortiEDR Central Manager, not FCS, is responsible for directly forwarding log records to FortiAnalyzer via syslog or API connectors.

B: OS metadata is gathered locally by the FortiEDR Collector and sent to the Core/Manager; it is not provided or sent by FCS.

1. Fortinet, "FortiEDR 7.0 Architecture Guide," Section: Fortinet Cloud Services (FCS), pp. 25-28.

2. Fortinet, "FortiEDR 7.0 NSE 6 Study Guide," Section: Threat Detection and FCS, pp. 45-48.