In a Fortinet Security Fabric automation stitch, the FortiGate acts as the central enforcement point. When FortiAnalyzer detects an Indicator of Compromise (IOC), it sends an event trigger to the FortiGate. The FortiGate then executes the configured action, which in this case is to send a notification to quarantine the compromised endpoint. This action can be a webhook to FortiClient EMS or applying a quarantine tag for ZTNA enforcement, but the FortiGate is the component that initiates the action.

A. FortiAnalyzer: FortiAnalyzer detects the IOC and sends the trigger, but it does not execute the quarantine action itself.

B. FortiClient: FortiClient is the endpoint agent that is the target of the quarantine action; it does not initiate it.

C. FortiClient EMS: FortiClient EMS receives the quarantine command from FortiGate and applies it to the endpoint, but it doesn't send the initial notification in the stitch.

1. FortiGate Administration Guide 7.4, "Automation stitches," page 1238. The guide explains that stitches consist of a trigger and one or more actions, which are configured and executed on the FortiGate.

2. FortiAnalyzer Administration Guide 7.4, "Event handlers," page 321. This section describes how FortiAnalyzer generates events that can be used as triggers for automation stitches on a FortiGate.

3. Fortinet Security Fabric Cookbook 7.4, "Automatically quarantine a compromised host," page 15. This recipe explicitly shows the FortiGate as the action component that quarantines a device based on a trigger from FortiAnalyzer.