Try our new research platform with insights from 80,000+ expert users
reviewer953235 - PeerSpot reviewer
Security Engineer at a recreational facilities/services company with 10,001+ employees
Real User
It runs very well on its own and doesn't really need much TLC
Pros and Cons
  • "FortiAnalyzer has a robust ability to find a compromised host on your network, and when you identify a compromised host, you can address it."
  • "Though FortiAnalyzer has improved over the last few versions, the user interface still has room for improvement. It's a bit dated-looking."

What is our primary use case?

The normal use case for FortiAnalyzer is log review, log analysis, etc.

How has it helped my organization?

FortiAnalyzer makes it much easier for us to find an apparently compromised host on the network.

What is most valuable?

FortiAnalyzer has a robust ability to find a compromised host on your network, and when you identify a compromised host, you can address it.

What needs improvement?

Though FortiAnalyzer has improved over the last few versions, the user interface still has room for improvement. It's a bit dated-looking. I guess that's the nicest way to describe it. In FortiAnalyzer, I would like the ability to turn off some of the services. So, for example, FortiAnalyzer can take data from FortiCamera products and turn off the FortiCamera stuff to lighten the load on the box or turn off the FortiSock product.

Buyer's Guide
Fortinet FortiAnalyzer
March 2025
Learn what your peers think about Fortinet FortiAnalyzer. Get advice and tips from experienced pros sharing their opinions. Updated: March 2025.
842,690 professionals have used our research since 2012.

For how long have I used the solution?

I've been using FortiAnalyzer for about seven years.

What do I think about the stability of the solution?

FortiAnalyzer is really stable. It runs very well on its own and doesn't really need much TLC. It's a good product.

What do I think about the scalability of the solution?

It's pretty scalable. The units that we have are the right size for the amount of stuff that we're running, but they do have products that scale up to handle significantly more Fortigate firewalls in log stuff than we do. I would say about 20 people use FortiAnalyzer. There's me, the security engineer, and the network engineering team, which uses it to look at stuff on the firewalls or check the firewall logs. And our information security group uses it to look at stuff that's going on with the firewalls as well as compromised hosts. It is being used pretty well as we get further down the path of deploying our FortiGate-managed endpoint product. There'll be more users and probably more use cases for it in the future.

Which solution did I use previously and why did I switch?

I haven't really used a different solution previously. We've always used FortiAnalyzer in concert with Splunk.

How was the initial setup?

FortiAnalyzer is a pretty straightforward product to deploy. It took half a day to deploy a pair of FortiAnalyzers and set them up in high availability mode. I deployed it by myself. These are hardware appliances, so there were a couple of devices that needed to be racked, powered, and configured.

What's my experience with pricing, setup cost, and licensing?

I believe that these devices were procured with a five-year maintenance and support license up front. I work at a university, so the vendor provides a considerable higher ed discount.

Which other solutions did I evaluate?

It's all part of our Fortinet ecosystem, so we didn't really consider alternatives. I have a significant investment in FortiGate firewalls, so it just made sense to add FortiAnalyzer.

What other advice do I have?

I rate FortiAnalyzer eight out of 10. It does an outstanding job of what it does. But the vendor doesn't necessarily live up to the hype, which is why it only got an eight out of 10. There's a lot of hype about the Fortinet security fabric. But for the large customers that buy their large firewalls and deploy them in infrastructure components, the Fortinet fabric does not work. If you are considering FortiAnalyzer, I suggest having a complete understanding of how your firewall infrastructure works in terms of what data you're going to and from it for analysis and what you're looking for in that analysis.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
reviewer2385126 - PeerSpot reviewer
Head Cyberdefense at a tech vendor with 5,001-10,000 employees
MSP
Top 5
Offers fast report generation and logging with easy deployment
Pros and Cons
  • "Report generation is very easy"
  • "The upgradation process is slow"

What is our primary use case?

As part of a company, we manage customers of Fortinet FortiAnalyzer. The solution is used to analyze and locate traffic in a particular network. 

How has it helped my organization?

Fortinet FortiAnalyzer has helped my organization improve operational efficiency. The company has been using it for ten years. 

What is most valuable?

Report generation is very easy when using Fortinet FortiAnalyzer. Checking and reading the logs becomes seamless with the solution. Fortinet FortiAnalyzer also allows fast logging on a license when requesting information. For example, when you are trying to locate a logged destination or using the tool to find an error or fault, the basic networking is very fast. 

What needs improvement?

The upgrade process for Fortinet FortiAnalyzer is slow. 

For how long have I used the solution?

I have been using Fortinet FortiAnalyzer for four years. 

What do I think about the stability of the solution?

Fortinet FortiAnalyzer is a stable product. 

What do I think about the scalability of the solution?

The solution is highly scalable. 

How was the initial setup?

It's easy to deploy Fortinet FortiAnalyzer. The solution needs to be upgraded every two or three years. The product is very easy to maintain. 

What's my experience with pricing, setup cost, and licensing?

Due to the multiple features and the large environment compatibility, the solution is quite expensive. I would rate the pricing an eight out of ten. 

Which other solutions did I evaluate?

At our company, Kibana is sometimes used to pull logs and develop graphical representations from it. 

What other advice do I have?

I would rate the solution an eight out of ten. I would advise others never to jump into upgrading to the latest firmware; wait until the present environment products are being used. There have been bad releases in the past, so everyone needs to carefully analyze options. 

Disclosure: My company has a business relationship with this vendor other than being a customer:
PeerSpot user
Buyer's Guide
Fortinet FortiAnalyzer
March 2025
Learn what your peers think about Fortinet FortiAnalyzer. Get advice and tips from experienced pros sharing their opinions. Updated: March 2025.
842,690 professionals have used our research since 2012.
Fasal Kp - PeerSpot reviewer
Senior System Administrator at SAGT
Real User
You can also download premade reports on the portal, but the user experience could be better
Pros and Cons
  • "FortiAnalyzer helps us discover what's happening on the network."
  • "They could always improve the interface and the user experience."

What is our primary use case?

FortiAnalyzer is a log analytics tool. Our company has around 600 to 700 people.

What is most valuable?

FortiAnalyzer helps us discover what's happening on the network.

What needs improvement?

They could always improve the interface and the user experience.

For how long have I used the solution?

I have used FortiAnalyzer for four or five years.

What do I think about the stability of the solution?

I rate FortiAnalyzer eight out of 10 for stability.

What do I think about the scalability of the solution?

Scalability is irrelevant to me because we have a small setup. One analyzer is enough for me.

How was the initial setup?

Setting up FortiAnalyzer isn't complex and takes two or three hours. They have a prebuilt OVA we can deploy using Ansible. Next, we configure FortiGate to send the logs to the FortiAnalyzer. You can also download premade reports on the portal.

What's my experience with pricing, setup cost, and licensing?

You pay an annual license based on the volume of logs per day.

What other advice do I have?

I rate FortiAnalyzer seven out of 10.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Yati Gharat - PeerSpot reviewer
Chief Technology Officer at Litmus
Real User
Top 5
Can be used by institutions whose data needs to be on-premises and not in the cloud
Pros and Cons
  • "I have found incident management and also identifying new threats, analyzing the network traffic, and finding out the issues with the network traffic such as any security issues to be valuable. I also like the compliance reports."
  • "One thing we struggled with FortiAnalyzer was integration with SIEM. We also had issues with the new threats and APTs. There were false positives, so we needed to have some ratings related to false positives."

What is our primary use case?

Most of our clients are banking and financial institutions, so their data doesn't go to the cloud as such. Their data is on-premises only. Some of our clients can go to the cloud to save the price and do management, administration, and so on, but then most of our clients, use on-premises FortiAnalyzer.

How has it helped my organization?

Fortianalyzer helped us to manage fortigate devices and update them from central location.

What is most valuable?

I have found incident management and also identifying new threats, analyzing the network traffic, and finding out the issues with the network traffic such as any security issues to be valuable. I also like the compliance reports.

It is a very stable and scalable solution.

What needs improvement?

One thing we struggled with FortiAnalyzer was integration with SIEM. We also had issues with the new threats and APTs. There were false positives, so we needed to have some ratings related to false positives.

It is easy to set up is you have FortiGate firewalls. We tried setting up with other devices, and I don't think it supports other firewalls or other devices. If it did, then it would have been great because we would have been able to use FortiAnalyzer for hybrid environments with different OEM firewalls.

If we can have an intelligent analysis system which will detect false positives and detect the exact problem, it would be great.  If FortiAnalyzer can integrate with FortiSIEM and give us threat reports, that will also help because then I won't need to have another tool or another dashboard which I need to look out for.

For how long have I used the solution?

I've been using it for four years.

What do I think about the stability of the solution?

It is a very stable product, and we have had no issues at all.

What do I think about the scalability of the solution?

It is easy to scale; there are no challenges.

How are customer service and support?

The technical support is good. Most of the time, when we escalate the tickets the second line of support, FortiGate support, has been very good. The first line might take up time, but the second line of support resolves the case quite quickly.

Which solution did I use previously and why did I switch?

Yes we used checkpoint for our organisation , but it was a complex system to manage, we expect a firewall to be a simple device to avoid complexity.

How was the initial setup?

The initial setup is quite simple with FortiGate devices. So, if you have FortiGate firewalls, it is quite easy to set up. Once Fortinet FortiAnalyzer is configured, then the only thing we need to do is to monitor it.

What's my experience with pricing, setup cost, and licensing?

When you compare with other firewall vendors, FortiAnalyzer is quite competitive in pricing. They are very aggressive as well.

Which other solutions did I evaluate?

Yes we did evaluate paloa alto , but it went into backburner due cost factor.

What other advice do I have?

If you have critical objects to protect or critical data to protect, then you should go for FortiAnalyzer.

On a scale from one to ten, I would rate Fortinet FortiAnalyzer at eight.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
PeerSpot user
Boller -Anyiine - PeerSpot reviewer
Security Solutions Architect at a manufacturing company with 1,001-5,000 employees
Real User
User-friendly and easy to set up with good logging
Pros and Cons
  • "Logging is the best feature."
  • "We would like to do the reporting, logging, and administration of all the public devices and all the IoT devices. We wish to add the switches, and routers from different vendors, so it's not a vendor-specific diagnostic solution."

What is our primary use case?

Most importantly, it is for the administration of Forti fabric devices and reporting of Forti fabric, and being able to generate reports. It's for logging. All 40 fabric devices are able to send logs to FortiAnalyzer. Basically, the use cases are for administration, reporting, and logging.

What is most valuable?

Logging is the best feature. 

I like how everything is integrated with the FortiGate devices, FortiAuthenticator, and other fabric devices. You're able to see all the login details for the administration of FortiGate. It offers great user connectivity using that Fortinet embodiment of the user. It gives you all those login information details.

It's easy to set up.

The solution is stable.

It can scale well. 

It's very user-friendly.

What needs improvement?

The fact that it only works with FortiGate devices is quite unfair. We would like to do the reporting, logging, and administration of all the public devices and all the IoT devices. We wish to add the switches, and routers from different vendors, so it's not a vendor-specific diagnostic solution.

For how long have I used the solution?

I've been using the solution for four years now. 

What do I think about the stability of the solution?

The product is 100% stable. I haven't found any issues with FortiAnalyzer. It's reliable.

What do I think about the scalability of the solution?

Depending on the licenses you procure, the number of devices, and the storage space that you have, to be able to attain those logs and reports, the solution can scale. 

How are customer service and support?

Support is great. Usually, when you call on them, they are right on time, and they'll be able to assign an engineer for remote session support.

How would you rate customer service and support?

Positive

How was the initial setup?

Setting the solution up is pretty easy. It's just a matter of integrating with the Fortinet public devices. FortiGate will start sending logs and then reports to FortiAnalyzer.

Once it is set up, the solution is easy to maintain.

What's my experience with pricing, setup cost, and licensing?

I'm not sure about the exact licensing costs.

What other advice do I have?

I'm working with the latest version of the solution. 

We've done on-premises and cloud deployments. 

Usually, clients who don't have SIEM or Nag solutions find FortiAnalyzer quite effective as it's going to give them identification of the user activity reports on different IO devices and the usage of devices. It gives you visibility of your entire infrastructure.

I'd recommend the solution. It's very user-friendly.

I'd rate the solution eight out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Implementer
PeerSpot user
reviewer1718736 - PeerSpot reviewer
Vice President of Innovation and Customer Solutions at a tech services company with 201-500 employees
Real User
Useful reports, scalable, and priced well
Pros and Cons
  • "The solution does what it is supposed to. I want it to do reports for Fortinet and it does it well."
  • "The FortiAnalyzer is not good at managing multi-version environments. If all your FortiGate are at different versions in the field, that's difficult. The one thing we didn't like is the fact you have to have 100% of your environment at the same release, which is not pleasant, to have it fully functional. You can have a different release, but to have it fully functional 100% of your environment has to be the same release."

What is our primary use case?

We're a managed service provider and we use Fortinet FortiAnalyzer to generate reports for our customers. We manage our customer's Fortinet environment and FortiAnalyzer allows us to send a monthly report or on-demand report to our customers.

What is most valuable?

The solution does what it is supposed to. I want it to do reports for Fortinet and it does it well.

What needs improvement?

The FortiAnalyzer is not good at managing multi-version environments. If all your FortiGate are at different versions in the field, that's difficult. The one thing we didn't like is the fact you have to have 100% of your environment at the same release, which is not pleasant, to have it fully functional. You can have a different release, but to have it fully functional 100% of your environment has to be the same release.

In a future release, if they could turn they could turn Fortinet FortiAnalyzer into a multi-vendor supporting tool it would be awesome. However, I do not think this will happen.

For how long have I used the solution?

I used Fortinet FortiAnalyzer for approximately two years.

What do I think about the scalability of the solution?

Fortinet FortiAnalyzer is scalable.

Fortinet FortiAnalyzer is easy to scale. We have approximately 50-100 employees using this solution.

Which solution did I use previously and why did I switch?

We have other log analyzers, but we have found with Fortinet FortiAnalyzerwhen you have a Fortinet environment, it's fully integrated. This was what we were looking for, we were not looking for multi-vendor solutions, we were looking for the best log analysis tool for Fortinet.

How was the initial setup?

The solution is easy to set up.

What's my experience with pricing, setup cost, and licensing?

We found the price of Fortinet FortiAnalyzer to be reasonable.

What other advice do I have?

I would advise those wanting to use Fortinet FortiAnalyzer to use an MSP, to use a managed service provider, they can call us.

I rate Fortinet FortiAnalyzer an eight out of ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Microsoft Azure
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
PeerSpot user
Group IT Manager at a manufacturing company with 1,001-5,000 employees
Real User
Great dashboard with customizable reporting and excellent logs
Pros and Cons
  • "There are customizable workflows that you can work with. You can automate certain tasks in FortiAnaylzer in the incidents and events sections."
  • "It's possible that they could add some advanced analytics and some proactive controls for logging analytics. That will help a lot."

What is our primary use case?

The Primary case is to collect & monitor logs & events from all of our firewalls and appliances in one single interface with analysis

How has it helped my organization?

Our work has been more focused and efficient due to the automatic notifications and reports

What is most valuable?

You can monitor all appliances from a centralized location. 

You have a front dashboard for all our operations and all the logs. If you need to search for anything you can just dig deep into the logs.

For example, if you are searching for an email to find out why it is blocked, you will be able to see the policy that blocked it, which logs were triggered, etc... It gives you all the information you need right there, from the dashboard.

The solution offers excellent customizable reports. In our case, we needed a monthly report of all internet consumption, and we were able to easily create this.

There are pre-defined templates. The logs cover any question or need that we populate within these templates. However, you can also build your own template.

There is great analytics that can be used in different departments. For example, our marketing department can go more into media patterns and not just into browsing patterns.

Everything is easily visible and can be tracked and studied.

SOC is very helpful. It shows which IPs are targeting your environments. It shows you the threat levels of all the threats you're facing - including the locations, which policy was triggered et cetera. It will even tell you if the system blocked the threat or not.

FortiAnaylzer is compatible with all of our web browsers. 

There are customizable workflows that you can work with. You can automate certain tasks in FortiAnaylzer in the incidents and events sections. 

What needs improvement?

It is a pretty big software package. It has a lot of features which maybe aren't that useful. 

It's possible that they could add some advanced analytics and some proactive controls for logging analytics. That will help a lot.

The could be more automation and more artificial intelligence integrated into the solution.

It was a service model application originally. It needs to have some artificial intelligence in dealing with the analysis of the nodes, and not just showing the nodes. I'm one version behind the latest version, so I don't know if they added it yet, however, if they haven't it would be a good thing to put into their roadmap.

For how long have I used the solution?

I've been using the solution for four years.

What do I think about the stability of the solution?

My solution is based on VM ova image which is predefined by Fortinet. I don't remember when was the last time I restarted the machine which shows no matter what is the size of logs collected the system doesn't crash.

What do I think about the scalability of the solution?

The scalability is pretty good. It's only limited in the log size. You can buy five gigs or 10 gigs if you need to. It depends on how you're going to handle/store the logs.

That said, it is scalable since you are only billed with the size of logs you are using as per the packages and you don't need to modify the cpu/ram. I have it installed on a VM environment and it's connecting to data all over my sites that are both inside and outside Lebanon.

How are customer service and technical support?

Technical support is perfect whether from the vendor or from the online support. I'm lucky to have a partner in Lebanon who is a preferred platinum partner with Fortinet. Whenever we open a case with them we always get a clear response. They are professional. We're quite satisfied with the level of support we are getting.

How was the initial setup?

It is very straight forward, the only thing that you might do some customization in the report and the event management. Other than this everything is predefined and based on templates, so you are able to add your touch on the reports as well.

What about the implementation team?

I have implemented it with a vendor who is the leader in our region working with Fortinet Solutions.

What other advice do I have?

We're Fortinet end-users.

I was on older versions and now I'm with a newer version. People have faced many issues after downloading the latest update so I tend to keep one update back from the newest one to avoid issues.

I'd advise other potential users that, first of all, if they have Fortinet products in their environment, they should consider FortiAnaylzer. If they don't have it, they shouldn't consider it. They need to have Fortinet appliances.

Secondly, it is a very easy configuration, so companies will not have any problems configuring the FortiAnaylzer. It doesn't require a lot of resources.

We're going to bring a dedicated server for our FortiAnaylzer due to the fact that it is a bit of a predefined virtual machine that we can download from Fortinet's side. If you don't want to go deep in the reports and logs, it can rely on the built-in reporting tools in your appliances.

If you happen to have three Fortinet solutions in your environment then you need to have a FortiAnaylzer as it helps a lot in troubleshooting. It helps a lot with predicting everything that you might see happening on a lot on your network. You will need to have FortiAnaylzer due to the fact that the reporting is not that advanced in the appliances.

Overall, I'd rate the solution eight out of ten. If it was more automated and added in some AI elements, I would rate it higher.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
PeerSpot user
Baherathan Kathirgamanathan - PeerSpot reviewer
Assistant Manager - Cloud Planning and Development at a comms service provider with 1,001-5,000 employees
Real User
Very good log analysis and reporting with a straightforward deployment
Pros and Cons
  • "The log analysis and reporting are both quite good."
  • "The solution lacks business intelligence features. It's much too basic."

What is our primary use case?

We're a service provider. Our clients use the solution for log management.

We are using physical and virtual end ware. We have a physical and logical virtual environment for using this platform, which we provide to our customers.

What is most valuable?

We are utilizing the previous site end dividers and the IPS, IDS DDoS features. 

The log analysis and reporting are both quite good. 

What needs improvement?

The solution doesn't have online analysis. We can't analyze certain parts of the logs. For example, we can't analyze current logs.

It would be helpful if we could use the system we use to monitor everything to also check the live traffic or live logs.

The solution lacks business intelligence features. It's much too basic.

For how long have I used the solution?

I've been using the solution for two or three years.

What do I think about the stability of the solution?

The solution is stable. We've never faced issues.

What do I think about the scalability of the solution?

The solution does not scale easily. It's a hardware solution. We have FortiAnalyzer hardware, and since it has a hardware agent on the storage ware, it requires Forti capacity for analyzing purposes. There's only a finite amount of space in the hardware itself. It isn't infinite.

How are customer service and technical support?

We've dealt with technical support in the past and we've been very satisfied at the level of support we've received so far.

How was the initial setup?

The initial setup varies from company to company. Some are straightforward, some are complex.

Deployment is a simple task. FortiAnalyzer comes with the hardware version and a virtual agent. We just deploy and integrate it with the other Fortinet products.

Which other solutions did I evaluate?

There is a lot of competition for Fortinet in this area, including USM and Palo Alto.

What other advice do I have?

We are Fortinet partners.

For those organizations that need to use a product for reporting or some analysis of logs, this is a good solution. 

I'd rate the solution seven out of ten. The features are basic, and there's not too much business intelligence behind them. If it offered more of that, I'd rate it higher.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
PeerSpot user
Buyer's Guide
Download our free Fortinet FortiAnalyzer Report and get advice and tips from experienced pros sharing their opinions.
Updated: March 2025
Product Categories
Log Management
Buyer's Guide
Download our free Fortinet FortiAnalyzer Report and get advice and tips from experienced pros sharing their opinions.