Fortinet FortiAnalyzer 800G Appliance
Centralized Logging, Analysis, and Reporting

Overview:

FortiAnalyzer is a powerful log management, analytics and reporting platform, providing organizations with Single-Pane Orchestration, Automation, and Response for simplified security operations, proactive identification and remediation of risks, and complete visibility of the entire attack surface.

FortiAnalyzer, integrated with Fortinet’s Security Fabric, provides advanced threat detection capabilities, centralized security analytics, and complete end-to-end security posture awareness and control, helping security teams identify and eliminate threats before a breach can occur.

Orchestrate security tools, people and process for streamlined execution of tasks and workflows, incident analysis and response, and rapidly expedite threat detection, case creation & investigation, and mitigation and response

Automate workflows and trigger actions with fabric connectors, playbooks and event handlers to accelerate your network security teams ability to respond to critical alerts and events, as well as SLA’s for regulation and compliance.

Respond in real-time to network security attacks, vulnerabilities and warnings of potential compromises, with threat intelligence, event correlation, monitoring, alerts and reporting for immediate tactical response and remediation.

Key Features:

• Security Fabric Analytics with event correlation and real-time detection across all logs, with Indicators of Compromise (IOC) service and detection of advanced threats
• Fortinet Security Fabric integration with FortiGates, FortiClient, FortiSandbox, FortiWeb, FortiMail, and others for deeper visibility and critical network insights
• Enterprise-grade High Availability to automatically back-up FortiAnalyzer databases (up to four node cluster), which can be geographically dispersed for disaster recovery
• Security Automation to reduce complexity, leveraging REST API, scripts, connectors, and automation stitches to expedite security response and reduce time-to-detect
• Multi-Tenancy solution with quota management, leveraging (ADOMs) to separate customer data and manage domains for operational effectiveness and compliance
• Flexible deployment options as appliance, VM, hosted, or public cloud. Use AWS, Azure, or Google for cloud secondary archival storage

Highlights:

Incident Detection and Response

Centralized NOC/SOC Visibility for the Attack Surface

The FortiSOC view helps teams in the security operations center (SOC) and network operations center (NOC) protect networks with access to real-time log and threat data in the form of actionable views with deep drill-down capabilities, notifications & reports, and predefined or customized dashboards for single-pane visibillty and awareness.

Event Management

FortiAnalyzer’s Event Manager enables security teams to monitor and manage alerts and events from logs. Events are processed and correlated in an easily readable format that analysts can understand for immediate response.

Incident Management

Analysts can assign incidents, view and drill down on event details, incident timelines, add analysis comments, attach reports and artifacts, and review playbook execution details for complete audit history.

Playbook Automation

FortiAnalyzer Playbooks boost an organization’s security teams abilities to simplify investigation efforts through automated incident response, freeing up resources and allowing analysts to focus on more critical tasks.

Security Services

Include the FortiSOC subscription to enable further automation for incident response with enhanced alert monitoring and escalation, built-in incident management work-flows, connectors, and many more FortiSOC playbooks.

Security Fabric Analytics

Analytics and Reporting

Security teams are empowered with FortiAnalyzer’s automation driven analytics and reports providing full visibility of network devices, systems, and users.

Assets and Identity

FortiAnalyzer’s Fabric View with Asset and Identity monitoring provides full SOC visibility of users and devices, including analytics of the attack surface and enables analysts to view and manage detailed UEBA information collected from logs and fabric devices, with filters and custom views for refining results.

With

• Fortiview
• Monitors
• LogView

FortiAnlayzer Reports

FortiAnalyzer provides over 60 report templates, 800+ datasets and 750+ charts that are ready-to-use with sample reports, including reports for Secure SDWAN, VPN monitoring, Threat Assessments, 360 Security Reviews, Situational Awareness, Self-harm and Risk Indicators, Bandwidth and Applications, FortiClient, FortiMail, FortiSandbox, FortiDeceptor, compliance, and many others

Deployments

• Deploying FortiAnalyzer
• FortiAnalyzer High Availability (HA)
• Multi-Tenancy with Flexible Quota Management
• Analyzer-Collector Mode
• Log Forwarding for Third-Party Integration

Cloud Services

FortiAnalyzer Cloud FortiAnalyzer Cloud offers customers a SaaS based delivery option for automation-driven, single pane analytics, providing log management, analytics and reporting for Fortinet NGFW and SD-WAN with an easily accessible cloud-based solution.

FortiAnalyzer Cloud delivers reliable real-time insights into network activity with extensive reporting and monitoring for clear, consistent visibility of an organizations security posture. With the FortiCloud Premium subscription customers can easily enable the FortiAnalyzer Cloud service with the 360 Protection bundle or by purchasing it a-la-carte, producing analytics for Fortinet Security Fabric devices and users. Customers and Partners can easily access their FortiAnalyzer Cloud from their FortiCloud Single-Sign-On Portal.

VIRTUAL OFFERINGS

FortiAnalyzer Virtual Machines are a virtual version of the hardware appliance and are designed to run on many virtualization platforms, offering all the latest features of the FortiAnalyzer appliance.FortiAnalyzer VMs are available in both a subscription and perpetual offering.

FortiAnalyzer VM-S

The new FortiAnalyzer Subscription license model consolidates the VM product SKU and the FortiCare Support SKU, as well as IOC and FortiAnalyzer SOC (SOAR/ SIEM) services into one single SKU, to simplify the product purchase, upgrade and renewal.

FortiAnalyzer VM

Fortinet offers the FortiAnalyzer VM in a stackable perpetual license model, with a-la-carte services available for 24x7 FortiCare support and subscription license for the FortiGuard Indicator of Compromise (IOC).

Specifications:

Particulars	Fortianalyzer 800G
Capacity and Performance
GB/Day of Logs	200
Analytic Sustained Rate (logs/sec)	4,000
Collector Sustained Rate (logs/sec)	6,000
Devices/VDOMs (Maximum)	800
Max Number of Days Analytics	50
Options Supports
FortiGuard Indicator of Compromise (IOC)
SOC Subscription
FortiGuard Outbreak Alert Service
Enterprise Bundle
Hardware Bundle
Hardware Specifications
Form Factor	1 RU Rackmount
Total Interfaces	4 x RJ45 GE, 2 x SFP
Storage Capacity	16 TB (4x 4 TB)
Usable Storage (After RAID)	8 TB
Removable Hard Drives
RAID Levels Supported	RAID 0/1,1s/5,5s/10
RAID Type	Hardware / Hot Swappable
Default RAID Level	10
Redundant Hot Swap Power Supplies	Optional
Dimensions
Height x Width x Length (inches)	1.73 x 17.32 x 21.65
Height x Width x Length (cm)	4.4 x 44.0 x 55.0
Weight	25.75 lbs (11.68 kg)
Environment
AC Power Supply	100–240V AC, 50–60 Hz
Power Consumption (Average)	134W / 174.2 W
Heat Dissipation	594.4 BTU/h
Operating Temperature	32 - 104° F (0 - 40° C)
Storage Temperature	-4–167° F (-20–75° C)
Humidity	5 to 95% non-condensing
Operating Altitude	Up to 7,400 ft (2,250 m)
Compliance
Safety Certifications	FCC Part 15 Class A, RCM, VCCI, CE, UL/cUL, CB

Documentation:

Download the Fortinet FortiAnalyzer Series Datasheet (PDF).