Fortinet FortiAnalyzer Centralized Management/Log/Analysis Appliance - FAZ-300G

Fortinet FortiAnalyzer FAZ-300G Centralized Management/Log/Analysis Appliance

FortiAnalyzer | Security-Driven Analytics and Log Management

FortiAnalyzer provides deep insights into advanced threats through Single-Pane Orchestration, Automation, and Response for your entire attack surface to reduce risks and improve your organization's overall security.

Integrated with Fortinet's Security Fabric, FortiAnalyzer simplifies the complexity of analyzing and monitoring new and emerging technologies that have expanded the attack surface, and delivers end-to-end visibility, helping you identify and eliminate threats.

Advanced Threat Detection and Correlation allows security and network teams to immediately identify and respond to network security threats across the infrastructure.

Automated Workflows and Compliance Reporting provides customizable dashboards, reports, and advanced workflow handlers for both security and network teams to accelerate workflows and assist with regulation and compliance audits.

Scalable Log Management collects logs from FortiGate, FortiClient, FortiManager, FortiSandbox, FortiMail, FortiWeb, FortiAuthenticator, Generic syslog, and others. Deploy as an individual unit or optimize for a specific operation, and scale storage based on retention requirements.

Feature Highlights | Security Operations Center

FortiAnalyzer's Security Operations Center (SOC) helps security teams protect networks with real-time log and threat data in the form of actionable views, notifications, and reports. Analysts can protect network, web sites, applications, databases, data centers, and other technologies through centralized monitoring, awareness of threats, events, and network activity. The predefined and custom dashboards provide a single-pane-of-glass for easy integration into your Security Fabric. The new FortiSOC service subscription provides built-in incident management workflows with playbooks and connectors to simplify the security analysts' role with enhanced security automation and orchestration.

Incident Detection and Response

FortiAnalyzer's automated incident response capability enables security teams to manage incident life cycle from a single view. Analysts can focus on event management and identification of compromised endpoints through default and customized event handlers with quick detection, automated correlation, and connected remediation of Fortinet devices and syslog servers with incident management and playbooks for quick assignment of incidents for analysis. Track timelines and artifacts with audit history and incident reports, as well as streamline integration with ITSM platforms that help bridge gaps in your Security Operations Center and reinforces your security posture.

FortiAnalyzer Playbooks

FortiAnalyzer Playbooks boost security team abilities to simplify efforts and focus on critical tasks. Out-of-the-box playbook templates enable SOC analysts to quickly customize and automate their investigation use cases to respond to compromised hosts, critical intrusions, blocking C&C IPs, and more. Flexible playbook editor for hosts under investigation. FortiAnalyzer also allows analysts to drill down to a playbook and review task execution details and edit playbooks to define custom processes and tasks. FortiAnalyzer includes built-in connectors for playbooks to interact with other Security Fabric devices like FortiOS and EMS.

 

Features

• Security Fabric Analytics: Event correlation across all logs and real-time anomaly detection, with Indicator of Compromise (IOC) service and threat detection, reducing time-to-detect
• Fortinet Security Fabric integration: Correlates with logs from FortiClient, FortiSandbox, FortiWeb, and FortiMail for deeper visibility and critical network insights
• Enterprise-grade High Availability: Automatically back-up FortiAnalyzer databases (up to four node cluster) that can be geographically dispersed for disaster recovery
• Security Automation: Reduce complexity and leverage automation via REST API, scripts, connectors, and automation stitches to expedite security response
• Multi-Tenancy and Administrative Domains (ADOMs): Separate customer data and manage domains leveraging
• ADOMs to be compliant and operationally effective
• Flexible Deployment Options and Archival Storage: Supports deployment of appliance, VM, hosted, or cloud. Use AWS, Azure, or Google to archive logs as a secondary storage