The solution is used for grabbing logs. It is designed for log aggregation of all Fortigate firewalls and to give visibility of traffic and usage.
Information security officer at a financial services firm with 1-10 employees
Good value for money, works well with other Fortinet solutions, and has helpful support
Pros and Cons
- "The log events are quite useful for us."
- "We'd like to see more embedded features."
What is our primary use case?
What is most valuable?
The log events are quite useful for us. The events aggregation from various Fortigate products makes it very helpful.
Technical support is helpful.
The stability is excellent.
This is a highly scalable product.
The setup is straightforward.
What needs improvement?
We'd like to see more embedded features.
We'd like to see more SIEM capabilities. I'd love to see this merged with FortiSIEM for example.
For how long have I used the solution?
I've been using the solution for around 20 years.
Buyer's Guide
Fortinet FortiAnalyzer
November 2024
Learn what your peers think about Fortinet FortiAnalyzer. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.
816,406 professionals have used our research since 2012.
What do I think about the stability of the solution?
The stability is great. I'd rate it ten out of ten for reliability. We rarely have any issues.
What do I think about the scalability of the solution?
You pay compared to the volume of logs you collect. It is very scalable. It's highly expandable. On a scale from one to ten, I'd rate the scalability ten out of ten.
We have less than five network engineers using the product.
How are customer service and support?
I've dealt with support in the past and found them helpful and responsive.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We use a variety of Fortigate products.
We did not use a different vendor previously. There is no other real option. We did try to use the free version of Splunk. We moved to Fortianalyzer as it works better in Fortinet products. Splunk is harder to fit into other Fortinet products.
How was the initial setup?
The installation process only takes a couple of hours. It is easy to install.
The maintenance is very minimal. One person can handle maintenance tasks.
What about the implementation team?
We do use specialized consultants occasionally. However, I have been able to do it by myself as well in the past.
What's my experience with pricing, setup cost, and licensing?
I cannot speak of the exact price. Someone else manages the contract. However, you do get good value for your money. It's not overly expensive.
As it is on-premises, you do need some on-prem resources. You need a traditional hypervisor and need the ability to host the solution on your premises.
What other advice do I have?
We're customers and end-users.
We are using the latest version of the solution typically.
I'd recommend the solution to other users.
I would rate the solution ten out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Vice President of Innovation and Customer Solutions at a tech services company with 201-500 employees
Useful reports, scalable, and priced well
Pros and Cons
- "The solution does what it is supposed to. I want it to do reports for Fortinet and it does it well."
- "The FortiAnalyzer is not good at managing multi-version environments. If all your FortiGate are at different versions in the field, that's difficult. The one thing we didn't like is the fact you have to have 100% of your environment at the same release, which is not pleasant, to have it fully functional. You can have a different release, but to have it fully functional 100% of your environment has to be the same release."
What is our primary use case?
We're a managed service provider and we use Fortinet FortiAnalyzer to generate reports for our customers. We manage our customer's Fortinet environment and FortiAnalyzer allows us to send a monthly report or on-demand report to our customers.
What is most valuable?
The solution does what it is supposed to. I want it to do reports for Fortinet and it does it well.
What needs improvement?
The FortiAnalyzer is not good at managing multi-version environments. If all your FortiGate are at different versions in the field, that's difficult. The one thing we didn't like is the fact you have to have 100% of your environment at the same release, which is not pleasant, to have it fully functional. You can have a different release, but to have it fully functional 100% of your environment has to be the same release.
In a future release, if they could turn they could turn Fortinet FortiAnalyzer into a multi-vendor supporting tool it would be awesome. However, I do not think this will happen.
For how long have I used the solution?
I used Fortinet FortiAnalyzer for approximately two years.
What do I think about the scalability of the solution?
Fortinet FortiAnalyzer is scalable.
Fortinet FortiAnalyzer is easy to scale. We have approximately 50-100 employees using this solution.
Which solution did I use previously and why did I switch?
We have other log analyzers, but we have found with Fortinet FortiAnalyzerwhen you have a Fortinet environment, it's fully integrated. This was what we were looking for, we were not looking for multi-vendor solutions, we were looking for the best log analysis tool for Fortinet.
How was the initial setup?
The solution is easy to set up.
What's my experience with pricing, setup cost, and licensing?
We found the price of Fortinet FortiAnalyzer to be reasonable.
What other advice do I have?
I would advise those wanting to use Fortinet FortiAnalyzer to use an MSP, to use a managed service provider, they can call us.
I rate Fortinet FortiAnalyzer an eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Microsoft Azure
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Buyer's Guide
Fortinet FortiAnalyzer
November 2024
Learn what your peers think about Fortinet FortiAnalyzer. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.
816,406 professionals have used our research since 2012.
Senior Network Engineer at Dejpaad
Easy to set up with good performance and reliability
Pros and Cons
- "It's easy to set up the product."
- "The solution costs too much."
What is our primary use case?
We use the solution for just one company for the analysis of the FortiGate switch.
What is most valuable?
The solution is scalable.
The performance is good.
It's easy to set up the product.
What needs improvement?
The solution costs too much.
For how long have I used the solution?
I've used the solution for about three years.
What do I think about the stability of the solution?
The solution has been stable and reliable. There are no bugs or glitches, and it doesn't crash or freeze.
What do I think about the scalability of the solution?
It's a scalable product and expands well.
Only admins use the solution. There are three to four people with direct access to the product.
How are customer service and support?
I do not have access to technical support. In Iran, we have sanctions, and so we cannot get support.
How was the initial setup?
The initial setup is pretty straightforward and simple. It's not overly complex or difficult to manage. We can deploy it in about two hours. You only need one person to handle the deployment and maintenance tasks as it is very simple.
What was our ROI?
We have witnessed a bit of an ROI and find the product to be worth the cost.
What's my experience with pricing, setup cost, and licensing?
We do need to pay for a license, and the payment is made yearly. There are no extra costs associated with the product beyond the main licensing fee.
It is an expensive solution.
Which other solutions did I evaluate?
We did not evaluate other solutions before choosing this product.
What other advice do I have?
Overall, I'd rate the product eight out of ten in terms of its functionality. I have been pleased with its capabilities so far. I'd recommend the solution to others.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Group IT Manager at a manufacturing company with 1,001-5,000 employees
Great dashboard with customizable reporting and excellent logs
Pros and Cons
- "There are customizable workflows that you can work with. You can automate certain tasks in FortiAnaylzer in the incidents and events sections."
- "It's possible that they could add some advanced analytics and some proactive controls for logging analytics. That will help a lot."
What is our primary use case?
The Primary case is to collect & monitor logs & events from all of our firewalls and appliances in one single interface with analysis
How has it helped my organization?
Our work has been more focused and efficient due to the automatic notifications and reports
What is most valuable?
You can monitor all appliances from a centralized location.
You have a front dashboard for all our operations and all the logs. If you need to search for anything you can just dig deep into the logs.
For example, if you are searching for an email to find out why it is blocked, you will be able to see the policy that blocked it, which logs were triggered, etc... It gives you all the information you need right there, from the dashboard.
The solution offers excellent customizable reports. In our case, we needed a monthly report of all internet consumption, and we were able to easily create this.
There are pre-defined templates. The logs cover any question or need that we populate within these templates. However, you can also build your own template.
There is great analytics that can be used in different departments. For example, our marketing department can go more into media patterns and not just into browsing patterns.
Everything is easily visible and can be tracked and studied.
SOC is very helpful. It shows which IPs are targeting your environments. It shows you the threat levels of all the threats you're facing - including the locations, which policy was triggered et cetera. It will even tell you if the system blocked the threat or not.
FortiAnaylzer is compatible with all of our web browsers.
There are customizable workflows that you can work with. You can automate certain tasks in FortiAnaylzer in the incidents and events sections.
What needs improvement?
It is a pretty big software package. It has a lot of features which maybe aren't that useful.
It's possible that they could add some advanced analytics and some proactive controls for logging analytics. That will help a lot.
The could be more automation and more artificial intelligence integrated into the solution.
It was a service model application originally. It needs to have some artificial intelligence in dealing with the analysis of the nodes, and not just showing the nodes. I'm one version behind the latest version, so I don't know if they added it yet, however, if they haven't it would be a good thing to put into their roadmap.
For how long have I used the solution?
I've been using the solution for four years.
What do I think about the stability of the solution?
My solution is based on VM ova image which is predefined by Fortinet. I don't remember when was the last time I restarted the machine which shows no matter what is the size of logs collected the system doesn't crash.
What do I think about the scalability of the solution?
The scalability is pretty good. It's only limited in the log size. You can buy five gigs or 10 gigs if you need to. It depends on how you're going to handle/store the logs.
That said, it is scalable since you are only billed with the size of logs you are using as per the packages and you don't need to modify the cpu/ram. I have it installed on a VM environment and it's connecting to data all over my sites that are both inside and outside Lebanon.
How are customer service and technical support?
Technical support is perfect whether from the vendor or from the online support. I'm lucky to have a partner in Lebanon who is a preferred platinum partner with Fortinet. Whenever we open a case with them we always get a clear response. They are professional. We're quite satisfied with the level of support we are getting.
How was the initial setup?
It is very straight forward, the only thing that you might do some customization in the report and the event management. Other than this everything is predefined and based on templates, so you are able to add your touch on the reports as well.
What about the implementation team?
I have implemented it with a vendor who is the leader in our region working with Fortinet Solutions.
What other advice do I have?
We're Fortinet end-users.
I was on older versions and now I'm with a newer version. People have faced many issues after downloading the latest update so I tend to keep one update back from the newest one to avoid issues.
I'd advise other potential users that, first of all, if they have Fortinet products in their environment, they should consider FortiAnaylzer. If they don't have it, they shouldn't consider it. They need to have Fortinet appliances.
Secondly, it is a very easy configuration, so companies will not have any problems configuring the FortiAnaylzer. It doesn't require a lot of resources.
We're going to bring a dedicated server for our FortiAnaylzer due to the fact that it is a bit of a predefined virtual machine that we can download from Fortinet's side. If you don't want to go deep in the reports and logs, it can rely on the built-in reporting tools in your appliances.
If you happen to have three Fortinet solutions in your environment then you need to have a FortiAnaylzer as it helps a lot in troubleshooting. It helps a lot with predicting everything that you might see happening on a lot on your network. You will need to have FortiAnaylzer due to the fact that the reporting is not that advanced in the appliances.
Overall, I'd rate the solution eight out of ten. If it was more automated and added in some AI elements, I would rate it higher.
Which deployment model are you using for this solution?
On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Security Engineer at a recreational facilities/services company with 10,001+ employees
It runs very well on its own and doesn't really need much TLC
Pros and Cons
- "FortiAnalyzer has a robust ability to find a compromised host on your network, and when you identify a compromised host, you can address it."
- "Though FortiAnalyzer has improved over the last few versions, the user interface still has room for improvement. It's a bit dated-looking."
What is our primary use case?
The normal use case for FortiAnalyzer is log review, log analysis, etc.
How has it helped my organization?
FortiAnalyzer makes it much easier for us to find an apparently compromised host on the network.
What is most valuable?
FortiAnalyzer has a robust ability to find a compromised host on your network, and when you identify a compromised host, you can address it.
What needs improvement?
Though FortiAnalyzer has improved over the last few versions, the user interface still has room for improvement. It's a bit dated-looking. I guess that's the nicest way to describe it. In FortiAnalyzer, I would like the ability to turn off some of the services. So, for example, FortiAnalyzer can take data from FortiCamera products and turn off the FortiCamera stuff to lighten the load on the box or turn off the FortiSock product.
For how long have I used the solution?
I've been using FortiAnalyzer for about seven years.
What do I think about the stability of the solution?
FortiAnalyzer is really stable. It runs very well on its own and doesn't really need much TLC. It's a good product.
What do I think about the scalability of the solution?
It's pretty scalable. The units that we have are the right size for the amount of stuff that we're running, but they do have products that scale up to handle significantly more Fortigate firewalls in log stuff than we do. I would say about 20 people use FortiAnalyzer. There's me, the security engineer, and the network engineering team, which uses it to look at stuff on the firewalls or check the firewall logs. And our information security group uses it to look at stuff that's going on with the firewalls as well as compromised hosts. It is being used pretty well as we get further down the path of deploying our FortiGate-managed endpoint product. There'll be more users and probably more use cases for it in the future.
Which solution did I use previously and why did I switch?
I haven't really used a different solution previously. We've always used FortiAnalyzer in concert with Splunk.
How was the initial setup?
FortiAnalyzer is a pretty straightforward product to deploy. It took half a day to deploy a pair of FortiAnalyzers and set them up in high availability mode. I deployed it by myself. These are hardware appliances, so there were a couple of devices that needed to be racked, powered, and configured.
What's my experience with pricing, setup cost, and licensing?
I believe that these devices were procured with a five-year maintenance and support license up front. I work at a university, so the vendor provides a considerable higher ed discount.
Which other solutions did I evaluate?
It's all part of our Fortinet ecosystem, so we didn't really consider alternatives. I have a significant investment in FortiGate firewalls, so it just made sense to add FortiAnalyzer.
What other advice do I have?
I rate FortiAnalyzer eight out of 10. It does an outstanding job of what it does. But the vendor doesn't necessarily live up to the hype, which is why it only got an eight out of 10. There's a lot of hype about the Fortinet security fabric. But for the large customers that buy their large firewalls and deploy them in infrastructure components, the Fortinet fabric does not work. If you are considering FortiAnalyzer, I suggest having a complete understanding of how your firewall infrastructure works in terms of what data you're going to and from it for analysis and what you're looking for in that analysis.
Which deployment model are you using for this solution?
On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Network & Security Administrator at Diamond Bank Plc
Simple solution that can is good for log collection but it should be more efficient
Pros and Cons
- "It is a simple and solution."
- "I'm looking for something more efficient to analyze different foreign things. That's why FortiSIEM could compete with FortiAnalyzer."
What is our primary use case?
We use the on-prem deployment model of this solution.
My primary use case for this solution is for log collection. I have a lot of FortiGates that I have to collect logs from, so I primarily use it for log collection. We plan to deploy a SIEM and we want to try to see how to integrate all the solutions to our SIEM. We are processing for PCI data specifications. We have to respond to PCI requirements, so that's why we are making some changes and acquiring some new security solutions to deploy. Among them, we have FortiSIEM and other security solutions like antivirus.
What is most valuable?
It is a simple and solution. I can structuralize all my FortiGate logs but it's not so good from the administrative side. I have FortiGate in four countries and I am responsible for securing Fortinet. I also have to manage FortiGate in other countries, not just my own. If I have to go through each FortiGate it's going to be a little bit complicated. FortiAnalyzer is a good product; but, I keep thinking that FortiAnalyzer isn't really what I'm looking for which is why I am looking to acquire a SIEM solution. It will give me more log collection possibilities.
What needs improvement?
I'm looking for something more efficient to analyze different foreign things. That's why FortiSIEM could compete with FortiAnalyzer.
For how long have I used the solution?
I have been using this solution in this company for three months.
How are customer service and technical support?
I haven't had to contact their technical support yet.
How was the initial setup?
The initial setup is not that complex. I didn't do the initial configuration, it was already set up, I'm only managing it right now. If we're talking about the integration side, like how to integrate FortiGate in FortiAnalyzer, I don't think it's complex. That's why they are known as one of the leaders in security.
What other advice do I have?
I would recommend this solution to somebody considering it.
The relevance of this solution will depend on the case. If you are considering this solution I would ask what you really intend to accomplish with it and what model you want. It's going to be based on the data you need to protect and analyze.
If I had to choose between FortiSIEM and FortiAnalyzer for log position it's better to go for SIEM. We all know that we can do a lot more with SIEM than just a log collection. Log collection is included in FortiSIEM; so, why acquire FortiAnalyzer is you can have FortiSIEM?
I would rate FortiAnalyzer a 6.5 out of ten.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Section Head, Enterprise Solutions & SI Management at HGC Global Communications Limited
Good performance, reliable, but interface could improve
Pros and Cons
- "The most valuable feature of Fortinet FortiAnalyzer is its performance."
- "Fortinet FortiAnalyzer could improve the user interface, and the experience of users receiving the reports and tracking could be better."
What is our primary use case?
We are using Fortinet FortiAnalyzer for the managing surface for our customers. We are a service provider and we are focusing on providing a service to our customers.
What is most valuable?
The most valuable feature of Fortinet FortiAnalyzer is its performance.
What needs improvement?
Fortinet FortiAnalyzer could improve the user interface, and the experience of users receiving the reports and tracking could be better.
For how long have I used the solution?
I have been using Fortinet FortiAnalyzer for approximately three years.
What do I think about the stability of the solution?
Fortinet FortiAnalyzer is stable.
How are customer service and support?
The support from Fortinet FortiAnalyzer is good.
How was the initial setup?
The initial setup of Fortinet FortiAnalyzer is fine. There is a lot of browsing and a lot of hierarchy that you need to have a particularly good understanding of in order to track the right things that you want to select.
What's my experience with pricing, setup cost, and licensing?
There is a license needed to use this solution.
What other advice do I have?
My advice to others is they have to assess well what kind of specific function or what kind of solution they are looking for.
I recommend this solution to others, but it depends on their usage.
I rate Fortinet FortiAnalyzer a seven out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Development and Innovation Manager at NSB
Good UI and customization with everything under one umbrella
Pros and Cons
- "The product can scale."
- "The pricing could be better."
What is our primary use case?
We are using it only for integration and getting information from FortiAnalyzer to use and analyze important events.
What is most valuable?
The stability is good.
They are able to integrate everything under one umbrella, which is nice.
The UI and customization are good right now.
The product can scale.
What needs improvement?
The pricing could be better.
We'd like integration with more providers.
The initial setup can be difficult.
For how long have I used the solution?
We've used the solution for about a year.
What do I think about the stability of the solution?
The stability of the product is good and it has been reliable. There are no bugs or glitches and it doesn't crash or freeze.
What do I think about the scalability of the solution?
The product can scale. It's simple to expand as necessary.
How are customer service and support?
I've never had to contact technical support. I cannot speak to how helpful or responsive they would be.
Which solution did I use previously and why did I switch?
We are using all the solutions from Fortinet, and FortiAnalyzer. We are planning to use FortiSIEM and FortiWeb.
How was the initial setup?
It's not too easy to set up. It can be a bit difficult. They could make it a little bit easier.
You only need two people (engineers) to handle deployment and maintenance.
What other advice do I have?
We are partners for Fortinet. So we are planning to use the FortiEDR, and then we're going to expand.
We only use FortiAnalyzer for internal purposes.
Our company is using the most up-to-date solution.
I'd advise potential users to look for a partner who knows how to handle the product and use their knowledge to give you quick training for your own people. The learning curve is not that easy.
I'd rate the solution eight out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Buyer's Guide
Download our free Fortinet FortiAnalyzer Report and get advice and tips from experienced pros
sharing their opinions.
Updated: November 2024
Product Categories
Log ManagementPopular Comparisons
Splunk Enterprise Security
Dynatrace
IBM Security QRadar
Elastic Security
Elastic Observability
LogRhythm SIEM
Sumo Logic Security
Grafana Loki
Security Onion
syslog-ng
Amazon CloudWatch
Buyer's Guide
Download our free Fortinet FortiAnalyzer Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- When evaluating Log Management tools and software, what aspect do you think is the most important to look for?
- Datadog vs ELK: which one is good in terms of performance, cost and efficiency?
- Which Windows event log monitoring tool do you recommend?
- What is the difference between log management and SIEM?
- Splunk vs. Elastic Stack
- How can Cloudtrail logs be used effectively to improve log monitoring?
- Why hot data and cold data differences in SIEM solutions are not discussed sufficiently?
- When evaluating Log Management solutions, what aspect do you think is the most important to look for?
- When evaluating Log Management solutions, what aspects do you think are the most important to look for?
- Why are Log Management tools important for companies?