DATA SHEET

FortiSIEM
Unified event correlation and risk
management for modern networks

FortiSIEM
Security and Compliance Made Easy

Highlights
Unified, Real-Time,

Security is no longer just about protecting information, it is critical to maintaining trust with
customers and protecting the organizations brand and reputation. Breaches cause
customers to take their business elsewhere, resulting in material and substantially negative
impacts to an organizations bottom line. Attracting new customers is estimated at seven
times more costly than keeping existing customers. Fines and legal fees can quickly add up.
Publicly traded organizations can see negative and lasting impacts to their stock value,
supplier relationships and shareholder perceptions. All these add up to explain why more
boards are getting involved in security decisions. FortiSIEM provides organizations with a
comprehensive, holistic and scalable solution, from IoT to the Cloud, with patented analytics
that are actionable to tightly manage network security, performance and compliance
standards, all delivered through a single pane of glass view of the organization.

NetworkAnalytics
Single IT Pane of Glass
Multi-tenancy
MSP/MSSP Ready
Cross Correlation of SOC &
NOCAnalytics
Self Learning Asset Inventory
Cloud Scale Architecture
Security and Compliance
out-of-the-box

FortiCare Worldwide 24x7 Support

FortiGuard Security Services

support.fortinet.com

www.fortiguard.com

DATA SHEET: FortiSIEM

HIGHLIGHTS
Unified NOC and SOC Analytics (Patented)

an essential part of compliance requirement management that

Fortinet has developed an architecture that enables unified and

FortSIEM is uniquely able to meet. An up-to-date (Centralized

cross-correlated analytics from diverse information sources

Management Database) CMDB enables sophisticated context

including logs, performance metrics, SNMP Traps, security alerts

aware event analytics using CMDB Objects in search conditions.

and configuration changes. FortSIEM essentially takes the analytics

traditionally monitored in separate silos from SOC and NOC

Dynamic User Identity Mapping

and brings that data together for a more holistic view of the threat

Crucial context for log analysis is connecting network identity

data available in the organization. Every piece of information is

(IP address, MAC Address) to user identity (log name, full name,

converted into an event which is first parsed and then fed into an

organization role). This information is constantly changing as users

event-based analytics engine for handling real-time searches, rules,

obtain new addresses via DHCP or VPN.

dashboards and ad-hoc queries.

Fortinet has developed a dynamic user identity mapping methodology.

External Threat Intelligence (TI) feeds from open source threat

First, users and their roles are discovered from on-premises

intelligence feeds, commercial sources and custom data sources

repositories such as Microsoft Active Directory and Open LDAP,

integrate easily into the FortSIEM TI framework. This grand

orfrom Cloud SSO repositories such as OKTA. This can be run

unification of diverse sources of data enables organizations to

on-demand or on a schedule to detect new users. Simultaneously,

quickly create comprehensive dashboards and reports to more

network identity is identified from important network events such as

rapidly identify root causes of threats, and take the steps necessary

firewall network translation events, Active Directory logons, VPN

to remediate and prevent them in the future.

logons, WLAN logons, Host Agent registration logs, etc. Finally,

bycombining user identity, network identity and geo-identity in a

Distributed Real-Time Event Correlation (Patented)

real-time distributed in-memory database, FortSIEM is able to form

Distributed event correlation is a difficult problem, as multiple nodes

a dynamic user identity audit trail. This makes it possible to create

have to share their partial states in real-time to trigger a rule. While

policies or perform investigations based on user identity instead of

many SIEM vendors have distributed data collection and distributed

IP addresses allowing for rapid problem resolution.

search capabilities, Fortinet is the only vendor with a distributed

time can be detected with minimal delay. This patented algorithm

Flexible and Fast Custom Log Parsing

Framework (Patented)

enables FortSIEM to handle a large number of rules in real-time at

Effective log parsing requires custom scripts but those can be slow

high event rates for greatly increased detection timeframes.

to execute, especially for high volume logs like Active Directory,

real-time event correlation engine. Complex event patterns in real-

firewall logs, etc. Compiled code on the other hand, is fast to

Real-Time, Automated Infrastructure Discovery

and Application Discovery Engine (CMDB)

execute but is not flexible since it needs new releases. Fortinet has

Rapid problem resolution requires infrastructure context. Most log

like high level programming languages and easy to modify yet can

analysis and SIEM vendors require administrators to provide the

be compiled during run-time to be highly efficient. All FortiSIEM

context manually, which quickly becomes stale, and is highly prone

parsers go beyond most competitors offerings using this patented

to human error. Fortinet has developed an intelligent infrastructure

solution and can be parsed at beyond 10K EPS per node.

and application discovery engine that is able to discover and map

developed an XML-based event parsing language that is functional

and in public/private clouds simply using credentials without any

Hybrid Database Architecture Leveraging

Structured and Unstructured Data Feeds

prior knowledge of what the devices or application is.

FortiSIEM takes advantage of two diverse sources of information

the topology of both physical and virtual infrastructure, on-premises

Discovery is both wide (covering a large number of Tier 1/2/3

vendors) and deep (covering system, hardware, software, running
services, applications, storage, users, network configuration,
topology and device relationships). Discovery can run on-demand
or on schedule to detect (in real-time) infrastructure changes and
report on any new devices and applications detected this is

discovered information is structured data suitable for a traditional

relational database, while logs, performance metrics etc. are
unstructured data which needs a NoSQL-type database. Fortinet
has developed a hybrid approach where the data is stored in
optimized databases with unique business layer logic providing a
comprehensive, single database abstraction layer.

www.fortinet.com

DATA SHEET: FortiSIEM

HIGHLIGHTS
using CMDB objects (stored in relational database). This approach

Large Enterprise and Managed Service Provider

Ready Multi-Tenant Architecture

harnesses the power and benefits of both databases.

Fortinet has developed a highly customizable, multi-tenant

The user is able to search for events (stored in NoSQL database)

Large Scale Threat Feed Integration

architecture that enables enterprises and service providers to

manage a large number of physical/logical domains and over-

There are many sources available for customers to subscribe to

lapping systems and networks from a single console. In this

external threat feeds in managing potential threats in their network.

environment it is very easy to cross-correlate information across

However, threat feed information can be very large, often reaching

physical and logical domains, and individual customer networks.

millions of IP addresses, malware domains, hashes and URLs, and

Unique reports, rules and dashboards can easily be built for each,

the information can also quickly become stale as malware websites

with the ability to deploy them across a wide set of reporting

and domain are taken down and brought up. This provides a

domains, and customers. Event archiving policies can also be

significant computational challenge to the consumers of threat

deployed on a per domain or customer basis.

intelligence data. Fortinet has developed proprietary algorithms that

enable this large amount of information to be quickly obtained from
the source, then effectively distributed to various FortiSIEM nodes
and evaluated in real-time at higher rates than other providers
(exceeding 10K EPS per node).

FEATURES
Real-Time Operational Context for Rapid
Security Analytics

Storage usage, performance monitoring EMC, NetApp, Isilon,

Continually updated and accurate device context

Specialized application performance monitoring

configuration, installed software and patches, running services

System and application performance analytics along with

Nutanix, Nimble, Data Domain

Microsoft Active Directory and Exchange via WMI and Powershell
Databases Oracle, MS SQL, MySQL via JDBC

contextual inter-relationship data for rapid triaging of security

VoIP infrastructure via IPSLA, SNMP, CDR/CMR

issues

Flow analysis and application performance Netflow, SFlow,

User context, in real-time, with audit trails of IP addresses,

Cisco AVC, NBAR

user identity changes, physical and geo-mapped location data

Ability to add custom metrics

context

Baseline metrics and detect significant deviations

Detect unauthorized network devices and applications,

configuration changes

Real-Time Configuration Change Monitoring

Collect network configuration files, stored in a versioned

Out-of-the-Box Compliance Reports

Out-of-the-box pre-defined reports supporting a wide range of
compliance auditing and management needs including
PCI-DSS, HIPAA, SOX, NERC, FISMA, ISO, GLBA, GPG13,
SANS Critical Controls

repository
Collect installed software versions, stored it in a versioned
repository
Automated detection of changes in network configuration and
installed software
Automated detection of file/folder changes Windows and

Performance Monitoring
Monitor basic system/common metrics
System level via SNMP, WMI, PowerShell
Application level via JMX, WMI, PowerShell
Virtualization monitoring for VMware, HyperV guest, host,

Linux who and what details

Automated detection of changes from an approved
configuration file
Automated detection of windows registry changes via FortiSIEM
windows agent

resource pool and cluster level

DATA SHEET: FortiSIEM

FEATURES
Device and Application Context
Network Devices including Switches, Routers, Wireless LAN
Security devices Firewalls, Network IPS, Web/Email
Gateways, Malware Protection, Vulnerability Scanners
Servers including Windows, Linux, AIX, HP UX
Infrastructure Services including DNS, DHCP, DFS, AAA,
Domain Controllers, VoIP
User-facing Applications including Web Servers, App Servers,
Mail, Databases
Storage devices including NetApp, EMC, Isilon, Nutanix,
DataDomain
Cloud Apps including AWS, Box.com, Okta, Salesforce.com

Specialized layered dashboards for business services, virtualized

infrastructure, and specialized apps

External Threat Intelligence Integrations

APIs for integrating external threat feed intelligence Malware
domains, IPs, URLs, hashes, Tor nodes
Built-in integration for popular threat intelligence sources
ThreatStream, CyberArk, SANS, Zeus
Technology for handling large threat feeds incremental
download and sharing within cluster, real-time pattern matching
with network traffic

Powerful and Scalable Analytics

Cloud infrastructure including AWS

Search events in real without the need for indexing

Environmental devices including UPS, HVAC, Device Hardware

Keyword-based searches & searches by parsed event attributes

Virtualization infrastructure including VMware ESX, Microsoft

Search historical events SQL-like queries with Boolean filter

HyperV

Scalable and Flexible Log Collection

Collect, Parse, Normalize, Index and Store security logs at very
high speeds (beyond 10K events/sec per node)
Out-of-the-box support for a wide variety of security systems
and vendor APIs both on-premises and cloud
Windows Agents provide highly scalable and rich event
collection including file integrity monitoring, installed software
changes and registry change monitoring
Linux Agents for file integrity monitoring
Modify parsers from within the GUI and redeploy on a running
system without downtime and event loss
Create new parsers (XML templates) via integrated parser

conditions, group by relevant aggregations, time-of-day filters,

regular expression matches, calculated expressions GUI & API
Trigger on complex event patterns in real-time
Use discovered CMDB objects and user/identity and location
data in searches and rules
Schedule reports and deliver results via email to key stakeholders
Search events across the entire organization, or down to a
physical or logical reporting domain
Dynamic watch lists for keeping track of critical violators with
the ability to use watch lists in any reporting rule
Scale analytics feeds by adding Worker nodes without downtime
Incident reporting prioritization can be implemented via critical
Business Service

development environment and share among users via

Base-lining and Statistical Anomaly Detection

export/import function

Baseline endpoint/server/user behavior hour of day and

Securely and reliably collect events for users and devices

located anywhere

Notification and Incident Management

weekday/weekend granularity
Highly flexible any set of keys and metrics can be baselined
Built-in and Customizable triggers on statistical anomalies

Policy-based incident notification framework

External Technology Integrations

Ability to trigger a remediation script when a specified

Integration with any external web site for IP address lookup

incidentoccurs
API-based integration to external ticketing systems
ServiceNow, ConnectWise, and Remedy
Built-in ticketing system

Rich Customizable Dashboards

Configurable real-time dashboards, with Slide-Show scrolling
for showcasing KPIs
Sharable reports and analytics across organizations and users
Color-coded for rapidly identifying critical issues
Fast updated via in-memory computation
4

API-based integration for external threat feed intelligence sources

API-based 2-way integration with help desk systems
seamless, out-of-the box support for ServiceNow, ConnectWise
and Remedy
API-based 2-way integration with external CMDB out-of-the
box support for ServiceNow and ConnectWise
Kafka support for integration with enhanced Analytics Reporting
i.e. ELK, Tableau and Hadoop
API for easy integration with provisioning systems
API for adding organizations, creating credentials, triggering
discovery, modifying monitoring events
www.fortinet.com

DATA SHEET: FortiSIEM

FEATURES
Simple and Flexible Administration

Threat Intelligence Center via Beaconing

Web-based GUI

FortiSIEM instances send health and anonymized incidents to

Rich Role-based Access Control for restricting access to GUI

and data at various levels

FortiSIEM Cloud
Cross-correlation across multiple FortiSIEM instances identifies

All inter-module communication protected by HTTPS

emerging trends and developing malware in the wild

Full audit trail of FortiSIEM user activity

Easy software upgrade with minimal downtime & event loss

Availability Monitoring

Easy way to update FortiSIEM knowledge base updates

System up/down monitoring via Ping, SNMP, WMI, Uptime

Analysis, Critical Interface, Critical Process and Service,

(parsers, rules, reports)

BGP/OSPF/EIGRP status change, Storage port up/down

Policy-based archiving
Hashing of logs at time for non-repudiation & integrity verification
Flexible user authentication local, external via Microsoft AD

Service availability modeling via Synthetic Transaction Monitoring

Ping, HTTP, HTTPS, DNS, LDAP, SSH, SMTP, IMAP, POP,
FTP, JDBC, ICMP, trace route and for generic TCP/UDP ports

and OpenLDAP, Cloud SSO/SAML via Okta

Hardware and environmental monitoring

Ability to log into remote server behind a collector from

Maintenance calendar for scheduling maintenance windows

FortiSIEM GUI via remote SSH tunnel

SLA calculation normal business hours and after-hours

Easily Scale Out Virtualized Architecture

considerations

Available as Virtual Machines for on-premises and public/private

cloud deployments on the following hypervisors VMware
ESX, Microsoft HyperV, KVM, Xen, Amazon Web Services AMI,
OpenStack, Azure
Scale data collection by deploying Collector virtual machines
Collectors can buffer events when connection to FortiSIEM
cloud is not available
Scale analytics by deploying Worker virtual machines
Built-in load balanced architecture for collecting events from
remote sites via collectors

SPECIFICATIONS
FortiSIEM Windows Agents
Fortinet has developed a highly efficient agentless technology for collecting information. However some information such as file integrity
monitoring data is expensive to collect remotely. FortSIEM has combined its agentless technology with newly developed high performance
agents to significantly bolster its data collection.
AGENTLESS
TECHNOLOGY

BASIC AGENT

Agentless

BASIC AGENT

ADVANCED
AGENT

Up to 500 Agents per Agent Manager

Discovery

Local Parsing and Time Normalization

Performance Monitoring

Installed Software Detection

Registry Change Monitoring

File Integrity Monitoring

Customer Log File Monitoring

WMI Command Output Monitoring

PowerShell Command Output Monitoring

(Low Performance) Collect System,

App & Security Logs

Agents

AGENTLESS
TECHNOLOGY

ADVANCED
AGENT

(High Performance) Collect System,

App & Security Logs

Collect DNS, DHCP, DFS, IIS Logs

Up to 1800 events/second/server loss less,

low latency

DATA SHEET: FortiSIEM

ORDER INFORMATION
Licensing Scheme
FortiSIEM licenses provide the core functionality for network device discovery. Devices include switches, routers, firewalls, servers, etc.
Each device that is to be monitored requires a license. Each license supports data capture and correlation, alerting and alarming, reports,
analytics, search and optimized data repository and includes 10 EPS (Events Per Second). EPS is a performance measurement that
defines how many messages or events are generated by each device in a second. Additional EPS can be purchased separately as needed.
Licenses are available in either a Subscription or Perpetual version.
PRODUCT

SKU

DESCRIPTION

FSM-AIO-BASE

Base perpetual license for Security and Monitoring Services all in one. Manages up to 50 devices and 500 EPS

FSM-AIO-XXXX-UG

Add XXXX devices and XXXX EPS for perpetual license

FSM-AIO-BASE-DD

Base subscription license for Security and Monitoring Services all in one. Manages up to 50 devices and 500 E

FortiSIEM All-In-One
FortiSIEM All-In-One Perpetual License
FortiSIEM All-In-One Subscription License
FortiCare Support for FortiSIEM All-In-One License

FSM-AIO-XXXX-UG-DD

Add XXXX devices and XXXX EPS for Subscription license

FC[1-8]-10-FSM00-248-02-DD

24x7 FortiCare Contract (YYYY devices)

FSM-WIN-BASE

Base perpetual license for 50 Basic Windows Agents

FortiSIEM Windows Agent

FortiSIEM Perpetual License for Basic Windows Agent

FSM-WIN-XXXX-UG

Add XXXX Basic Windows Agents for perpetual license

FortiSIEM Subscription License for Basic Windows Agent

FSM-WIN-BASE-DD

Base subscription license for 50 Basic Windows Agents

FSM-WIN-XXXX-UG-DD

Add XXXX Basic Windows Agents for subscription license

FortiSIEM Perpetual License for Advanced Windows Agent

FSM-WIN-ADV-BASE

Base perpetual license for 50 Advanced Windows Agents

FSM-WIN-ADV-XXXX-UG

Add XXXX Advanced Windows Agents for perpetual license

FortiSIEM Subscription License for Advanced Windows Agent

FSM-WIN-ADV-BASE-DD

Base subscription license for 50 Advanced Windows Agents

FSM-WIN-ADV-XXXX-UG-DD

Add XXXX Advanced Windows Agents for subscription license

FortiCare Support for FortiSIEM Windows Agent License

FC[1-8]-10-FSM01-248-02-DD

24x7 FortiCare Contract (YYYY devices)

FORTISIEM ALL-IN-ONE ENTITLEMENT

BASE

UPGRADE TIERS (XXXX)

Base

100

250

450

950

1950

3950

4950

Number of Devices

50

100

250

450

950

1,950

3,950

4.950

Number of EPS

500

1,000

2,500

4,500

9,500

19,500

39,500

49,500

FORTISIEM WINDOWS AGENT ENTITLEMENT

BASE

UPGRADE TIERS (XXXX)

Base

100

250

450

950

1950

3950

4950

Number of Windows Agents

50

100

250

450

950

1,950

3,950

4.950

FORTICARE ENTITLEMENT

OPTIONS
1

Number of Devices (YYYY)

150

1150

1300

1500

11,00

12,000

14,000

15,000

GLOBAL HEADQUARTERS
Fortinet Inc.
899 Kifer Road
Sunnyvale, CA 94086
United States
Tel: +1.408.235.7700
www.fortinet.com/sales

EMEA SALES OFFICE

905 rue Albert Einstein
Valbonne 06560
Alpes-Maritimes, France
Tel: +33.4.8987.0500

APAC SALES OFFICE

300 Beach Road 20-01
The Concourse
Singapore 199555
Tel: +65.6395.2788

LATIN AMERICA SALES OFFICE

Sawgrass Lakes Center
13450 W. Sunrise Blvd., Suite 430
Sunrise, FL 33323
United States
Tel: +1.954.368.9990

Copyright 2016 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be
trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary and may be significantly less effective than the metrics stated herein. Network variables, different network environments
and other conditions may negatively affect performance results and other metrics stated herein. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinets General
Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet and any such commitment
shall be limited by the disclaimers in this paragraph and other limitations in the written contract. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinets internal lab tests, and in no event will Fortinet be responsible for events or issues that are outside of its
reasonable control. Notwithstanding anything to the contrary, Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version
of the publication shall be applicable
FST-PROD-DS-FSIEM FSIEM-DAT-R1-201607