Description
Fortinet FortiSIEM FSM-500G collector hardware appliance risk management
Unified Event Correlation and Risk Management for
Modern Networks
Uptime is a mandate for today’s digital business and end users do not care if their
application problems are performance or security-related. That’s where FortiSIEM
comes in.
Unified NOC and SOC Analytics (Patented)
Fortinet has developed an architecture that enables unified data collection and analytics
from diverse information sources including logs, performance metrics, SNMP Traps,
security alerts, and configuration changes. FortiSIEM essentially takes the analytics
traditionally monitored in separate silos — SOC and NOC — and brings that data
together for a comprehensive view of the security and availability of the business. Every
piece of information is converted into an event which is first parsed and then fed into an
event-based analytics engine for monitoring real-time searches, rules, dashboards, and
ad-hoc queries.
Modern Networks
Uptime is a mandate for today’s digital business and end users do not care if their
application problems are performance or security-related. That’s where FortiSIEM
comes in.
Unified NOC and SOC Analytics (Patented)
Fortinet has developed an architecture that enables unified data collection and analytics
from diverse information sources including logs, performance metrics, SNMP Traps,
security alerts, and configuration changes. FortiSIEM essentially takes the analytics
traditionally monitored in separate silos — SOC and NOC — and brings that data
together for a comprehensive view of the security and availability of the business. Every
piece of information is converted into an event which is first parsed and then fed into an
event-based analytics engine for monitoring real-time searches, rules, dashboards, and
ad-hoc queries.
Machine Learning / UEBA
FortiSIEM uses Machine Learning to detect unusual user and entity behavior (UEBA) without
requiring the Administrator to write complex rules. FortiSIEM helps identify insider and
incoming threats that would pass traditional defenses. High fidelity alerts help prioritize which
threats need immediate attention.
User and Device Risk Scoring
FortiSIEM build a risk scores of Users and Devices that can augment UEBA rules and other
analysis. Risk scores are calculated by combining several datapoints regarding the user and
device. The User and Device risk scores are displayed in a unified entity risk dashboard.
Distributed Real-Time Event Correlation (Patented)
Distributed event correlation is a difficult problem, as multiple nodes have to share their partial
states in real time to trigger a rule. While many SIEM vendors have distributed data collection
and distributed search capabilities, Fortinet is the only vendor with a distributed real-time
event correlation engine. Complex event patterns can be detected in real time. This patented
algorithm enables FortiSIEM to handle a large number of rules in real time at high event rates
for accelerated detection timeframes.
FortiSIEM uses Machine Learning to detect unusual user and entity behavior (UEBA) without
requiring the Administrator to write complex rules. FortiSIEM helps identify insider and
incoming threats that would pass traditional defenses. High fidelity alerts help prioritize which
threats need immediate attention.
User and Device Risk Scoring
FortiSIEM build a risk scores of Users and Devices that can augment UEBA rules and other
analysis. Risk scores are calculated by combining several datapoints regarding the user and
device. The User and Device risk scores are displayed in a unified entity risk dashboard.
Distributed Real-Time Event Correlation (Patented)
Distributed event correlation is a difficult problem, as multiple nodes have to share their partial
states in real time to trigger a rule. While many SIEM vendors have distributed data collection
and distributed search capabilities, Fortinet is the only vendor with a distributed real-time
event correlation engine. Complex event patterns can be detected in real time. This patented
algorithm enables FortiSIEM to handle a large number of rules in real time at high event rates
for accelerated detection timeframes.
Real-Time, Automated Infrastructure Discovery and Application Discovery Engine (CMDB)
Rapid problem resolution requires infrastructure context. Most log analysis and SIEM vendors
require administrators to provide the context manually, which quickly becomes stale, and is
highly prone to human error. Fortinet has developed an intelligent infrastructure and application
discovery engine that is able to discover both physical and virtual infrastructure, on-premises
and in public/ private clouds, simply using credentials without any prior knowledge of what the
devices or applications are.
An up-to-date CMDB (Centralized Management Database) enables sophisticated context
aware event analytics using CMDB Objects in search conditions.
Dynamic User Identity Mapping
Crucial context for log analysis is connecting network identity (IP address, MAC Address) to
user identity (log name, full name, organization role). This information is constantly changing as
users obtain new addresses via DHCP or VPN.
Fortinet has developed a dynamic user identity mapping methodology. Users and their roles
are discovered from on-premises or Cloud SSO repositories. Network identity is identified from
important network events. Then geo-identity is added to form a dynamic user identity audit
trail. This method makes it possible to create policies or perform investigations based on user
identity instead of IP addresses — allowing for rapid problem resolution.
Rapid problem resolution requires infrastructure context. Most log analysis and SIEM vendors
require administrators to provide the context manually, which quickly becomes stale, and is
highly prone to human error. Fortinet has developed an intelligent infrastructure and application
discovery engine that is able to discover both physical and virtual infrastructure, on-premises
and in public/ private clouds, simply using credentials without any prior knowledge of what the
devices or applications are.
An up-to-date CMDB (Centralized Management Database) enables sophisticated context
aware event analytics using CMDB Objects in search conditions.
Dynamic User Identity Mapping
Crucial context for log analysis is connecting network identity (IP address, MAC Address) to
user identity (log name, full name, organization role). This information is constantly changing as
users obtain new addresses via DHCP or VPN.
Fortinet has developed a dynamic user identity mapping methodology. Users and their roles
are discovered from on-premises or Cloud SSO repositories. Network identity is identified from
important network events. Then geo-identity is added to form a dynamic user identity audit
trail. This method makes it possible to create policies or perform investigations based on user
identity instead of IP addresses — allowing for rapid problem resolution.
Reviews
There are no reviews yet.