FortiEDR

The OpenCTI FortiEDR connector synchronises IP indicators of compromise from OpenCTI to a FortiEDR IP Set in real time. Leveraging OpenCTI live streams, IPv4 and IPv6 indicators are kept in sync with a managed FortiEDR IP Set through the FortiEDR Central Manager REST API, so endpoint policies can act on known-bad infrastructure. File hashes, domains and URLs are best ingested through FortiEDR's native STIX/TAXII Threat Intelligence Feed pointed at OpenCTI's TAXII server.