What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

Question

Miguel Tuimil Galdo · Accepted Answer

A new infected entry is added for the corresponding endpoint under Compromised Hosts.

Miguel Tuimil Galdo · Answer

FortiAnalyzer flags the associated host for further analysis.

Miguel Tuimil Galdo · Answer

The detection engine classifies those logs as Suspicious.

Miguel Tuimil Galdo · Answer

The endpoint is marked as Compromised and, optionally, can be put in quarantine.

List of questions