Overview:
Uptime is a mandate for today’s digital business and end users do not care if their application problems are performance or security-related. That’s where FortiSIEM comes in.
Unified NOC and SOC Analytics (Patented)
Fortinet has developed an architecture that enables unified data collection and analytics
from diverse information sources including logs, performance metrics, SNMP Traps,
security alerts, and configuration changes. FortiSIEM essentially takes the analytics
traditionally monitored in separate silos — SOC and NOC — and brings that data
together for a comprehensive view of the security and availability of the business. Every
piece of information is converted into an event which is first parsed and then fed into an
event-based analytics engine for monitoring real-time searches, rules, dashboards, and
ad-hoc queries.
Highlights
- Cross Correlation of SOC and NOC Analytics
- Real-Time Network Analytics
- Security and Compliance out-of-the-box
- Single IT Pane of Glass
- Cloud Scale Architecture
- Self Learning Asset Inventory (CMDB)
- Multi-tenancy
- MSP/MSSP Ready
- Available as a virtual or physical appliance
Highlights:
Machine Learning / UEBA
FortiSIEM uses Machine Learning to detect unusual user and entity behavior (UEBA) without
requiring the Administrator to write complex rules. FortiSIEM helps identify insider and
incoming threats that would pass traditional defenses. High fidelity alerts help prioritize which
threats need immediate attention.
User and Device Risk Scoring
FortiSIEM build a risk scores of Users and Devices that can augment UEBA rules and other
analysis. Risk scores are calculated by combining several datapoints regarding the user and
device. The User and Device risk scores are displayed in a unified entity risk dashboard.
Distributed Real-Time Event Correlation (Patented)
Distributed event correlation is a difficult problem, as multiple nodes have to share their partial states in real time to trigger a rule. While many SIEM vendors have distributed data collection and distributed search capabilities, Fortinet is the only vendor with a distributed real-time event correlation engine. Complex event patterns can be detected in real time. This patented algorithm enables FortiSIEM to handle a large number of rules in real time at high event rates for accelerated detection timeframes.
Real-Time, Automated Infrastructure Discovery and Application Discovery Engine (CMDB)
Rapid problem resolution requires infrastructure context. Most log analysis and SIEM vendors
require administrators to provide the context manually, which quickly becomes stale, and is
highly prone to human error. Fortinet has developed an intelligent infrastructure and application
discovery engine that is able to discover both physical and virtual infrastructure, on-premises
and in public/ private clouds, simply using credentials without any prior knowledge of what the
devices or applications are.
An up-to-date CMDB (Centralized Management Database) enables sophisticated context aware event analytics using CMDB Objects in search conditions
Dynamic User Identity Mapping
Crucial context for log analysis is connecting network identity (IP address, MAC Address) to
user identity (log name, full name, organization role). This information is constantly changing as
users obtain new addresses via DHCP or VPN.
Fortinet has developed a dynamic user identity mapping methodology. Users and their roles
are discovered from on-premises or Cloud SSO repositories. Network identity is identified from
important network events. Then geo-identity is added to form a dynamic user identity audit
trail. This method makes it possible to create policies or perform investigations based on user
identity instead of IP addresses—allowing for rapid problem resolution.
Flexible and Fast Custom Log Parsing Framework (Patented)
Effective log parsing requires custom scripts but those can be slow to execute, especially for
high volume logs like Active Directory and firewall logs. Compiled code on the other hand, is
fast to execute but is not flexible since it needs new software releases. Fortinet has developed
an XML-based event parsing language that is functional like high level programming languages
and easy to modify yet can be compiled during run-time to be highly efficient.
Business Services Dashboard — Transforms System to Service Views
Traditionally, SIEM’s monitor individual components — servers, applications, databases, and
so forth — but what most organizations really care about is the services those systems
power. FortiSIEM now offers the ability to associate individual components with the end user
experience that they deliver together providing a powerful view into the true availability of the
business.
Automated Incident Mitigation
When an Incident is triggered, an automated script can be run to mitigate or eliminate the
threat. Built-in scripts support a variety of devices including Fortinet, Cisco, Palo Alto, and
Window/Linux servers. Built-in scripts can execute a wide range of actions including disabling
a user’s Active Directory account, disabling a switch port, blocking an IP address on a Firewall,
deauthenticating a user on a WLAN Access Point, and more. Scripts leverage the credentials
FortiSIEM already has in the CMDB. Administrators can easily extend the actions available by
creating their own scripts
Infusion of Security Intelligence
FortiGuard Threat Intelligence and Indicators of Compromise (IOC) and Threat Intelligence
(TI) feeds from commercial, open source, and custom data sources integrate easily into the
security TI framework. This grand unification of diverse sources of data enables organizations
to rapidly identify root causes of threats, and take the steps necessary to remediate and
prevent them in the future. Steps can often be automated with new Threat Mitigation Libraries
for many Fortinet products.
Large Enterprise and Managed Service Provider Ready — “Multi-Tenant Architecture”
Fortinet has developed a highly customizable, multi-tenant architecture that enables
enterprises and service providers to manage a large number of physical/ logical domains and
over-lapping systems and networks from a single console. In this environment it is very easy
to cross-correlate information across physical and logical domains, and individual customer
networks. Unique reports, rules, and dashboards can easily be built for each, with the ability to
deploy them across a wide set of reporting domains, and customers. Event archiving policies
can also be deployed on a per domain or customer basis. Granular RBAC controls allow varying
levels of access to Administrators and Tenants/ Customers. For large MSSPs, Collectors can be
configured as multi-tenant to reduce the overall deployment footprint.
FortiSIEM Advanced Agents:
Fortinet has developed a highly efficient agentless technology for collecting information. However some information, such as file integrity monitoring data, is expensive to collect remotely. FortiSIEM has combined its agentless technology with high performance agents for Windows and Linux to significantly bolster its data collection.
|
Agentless Technology |
Advanced Windows Agent |
Advanced Linux Agent |
| Discovery |
|
|
|
| Performance Monitoring |
|
|
|
| (Low Performance) Collect System, App & Security Logs |
|
|
|
| (High Performance) Collect System, App & Security Logs |
|
|
|
| Collect DNS, DHCP, DFS, IIS Logs |
|
|
|
| Local Parsing and Time Normalization |
|
|
|
| Installed Software Detection |
|
|
|
| Registry Change Monitoring |
|
|
|
| File Integrity Monitoring |
|
|
|
| Customer Log File Monitoring |
|
|
|
| WMI Command Output Monitoring |
|
|
|
| PowerShell Command Output Monitoring |
|
|
|
| Central Management and Upgrades of Agent |
|
|
|
Licensing Scheme
FortiSIEM Virtual Appliance (VA) and Hardware Appliance (HW)
FortiSIEM provides subscription and perpetual licenses.
The Devices + EPS license is available on software/virtual and hardware appliance deployments in subscription and perpetual terms. A Device license supports data capture and correlation, alerting and alarming, reports, analytics, search, and includes 10 EPS (events per second). EPS is a performance measurement that defines how many messages or events each device generates in a second. Additional EPS can be purchased separately from the Device license.
FortiSIEM GB per day is available as a subscription license on software deployments. FortiSIEM measures the GB per day storage of uncompressed event data. Please check GB per day licensing support for availability in FortiSIEM 7.2.x release notes. FortiSIEM GB per day licensing is supported with the ClickHouse event database only.
FortiSIEM Cloud
FortiSIEM Cloud unifies all licensed components that are available with VA and HW licensing within the FortiSIEM Compute Units
(FCU). Every 10 FCU provides a licensed daily average of 1K EPS. FortiSIEM Cloud is licensed on FCU, Online storage [maximum
quantity 120 (60 TB)], and Archive storage and depending on the performance requirements additional FCU or storage can be
added. FCUs are licensed with increments of 10 FCU with a minimum quantity of 10 (recommended >=20) and a maximum of
600 FCU. A minimum of 500GB on online storage is required.
