FortiAnalyzer

Why do you need FortiAnalyzer?

The average SOC wastes 27% of time on manual log collection and correlation. Without central analytics, security teams react post-factum, not seeing the full threat picture. Compliance reporting is additional hours of work.

FortiAnalyzer is a central SIEM/SOC platform for the Fortinet ecosystem. Collects logs from the entire Security Fabric, correlates events in real-time and automates response through FortiSOC playbooks. 700+ pre-built reports for compliance.

How does it work?

Centralized Log Collection

Collection from entire Security Fabric:

• FortiGate, FortiSwitch, FortiAP
• FortiMail, FortiWeb, FortiClient
• 10:1 compression and deduplication
• Long-term retention

Security Analytics

Real-time correlation and detection:

• Event correlation engine
• Behavioral analytics
• Machine learning
• Threat intelligence integration

FortiSOC

Built-in SOC functions:

• Alert management and triage
• Case management with collaboration
• Playbook automation
• Incident response workflow

Key Features

Dashboards & Visualization

• Pre-built security dashboards
• Custom widgets
• Real-time updates
• Drill-down analysis

Compliance Reporting

• 700+ pre-built reports
• PCI DSS, HIPAA, GDPR, SOC 2
• Custom report builder
• Scheduled delivery

Threat Intelligence

• FortiGuard IoC feed
• STIX/TAXII import
• Custom indicators
• Automated detection

Automation

• Visual playbook builder
• Pre-built templates
• Email/ticket notifications
• Device action automation

Deployment Models

FortiAnalyzer-VM: Flexible, variable log rate/storage

FAZ-200G/400G/1000G/3000G: Hardware appliances

FortiAnalyzer Cloud: SaaS without infrastructure

Who is it for?

• Fortinet organizations seeking central security visibility
• SOC teams needing analytics and automation
• Companies with compliance requirements (PCI, HIPAA, GDPR)
• MSPs managing multiple Fortinet clients

Benefits

For SOC: Central visibility, playbook automation, faster response

For compliance: 700+ ready reports, scheduled delivery, audit trail

For business: Lower SOC OPEX, native Fabric integration, measurable ROI

Specification

Log rate	Up to 3 TB/day (FAZ-3000G)
Reports	700+ pre-built
Storage	Up to 76 TB (FAZ-3000G)
Multi-tenant	ADOM

FAQ

How does FortiAnalyzer differ from FortiSIEM? FortiAnalyzer is optimized for Fortinet Fabric. FortiSIEM for multi-vendor environments with UEBA and CMDB.

Do I need FortiManager for FortiAnalyzer? No. They work independently, but can be integrated for unified console.

How many logs can it store? Depending on model - from several TB (VM) to 76 TB (FAZ-3000G). Cloud practically without limits.

Which compliance frameworks are supported? PCI DSS, HIPAA, GDPR, SOC 2, NIST, ISO 27001, plus custom frameworks.

How do playbooks work? Visual builder, trigger-based automation, integration with Fabric devices, email/ticketing.

Can I import threat intelligence? Yes. STIX/TAXII feeds, custom IoC, FortiGuard integration.

How does log retention work? Configurable - from days to years. Archiving to external storage optionally.

Does FortiAnalyzer support multi-tenancy? Yes. ADOM (Administrative Domains) for MSP and enterprise with separation.

How does licensing work? Per log rate (GB/day) or per source device. Cloud subscription available.

What does support look like? Fortinet 24/7 TAC. nFlo as partner offers SOC deployment and training.