Refer to The exhibit showing a FortiEDR configuration.

The presence of a cryptolocker malware at rest on the filesystem will be detected by the Ransomware Prevention security policy.

FortiEDR Collector will not collect OS Metadata.

If a malicious file is executed and attempts to establish a connection it will generate duplicate events.

If an unresolved file rule is triggered, by default the file is logged but not blocked.