FortiSIEM®

Unified event correlation and risk management for modern networks

Today’s digital business is increasingly driven

on IoT, cloud services and more to stay closer
to customers than ever. This reliance makes
uptime critical to growth and profitability.
As such, an end user doesn’t care if their
application service problems are performance
or security-related.

Free Up Teams Highlights

Organizations know that digitalization has the potential to transform
their business. But lack of time, and expertise more often hinder
IT teams from planning for such an ambitious future. In fact, in its §§ Real-Time Network Analytics
annual CIO survey, IDG found that 72% of respondents struggle to §§ Security and Compliance out-of-the-box
juggle business innovation and operational excellence requirements. §§ Single IT Pane of Glass
And the number of challenges isn’t decreasing: 87% said they
§§ Cloud Scale Architecture
are increasing.
§§ Self Learning Asset Inventory (CMDB)
What’s needed is a way to free up time for overburdened IT teams
that often handle IT support, security and even compliance in §§ Multi-tenancy
many cases. §§ MSP/MSSP Ready

Automation is the Key §§ Cross Correlation of SOC &

An effective way to create time to develop new staff skills and tackle NOC Analytics
strategic projects is to automate time-consuming tasks that take §§ Available as a virtual or
significant human effort. Specifically, introducing tools to monitor physical appliance
IT, security and compliance, proactively identify issues before they
become major problems and even streamline resolution can free up
individuals to focus on higher value activities.

DATA SHEET
FortiSIEM
®

HIGHLIGHTS

Unified NOC and SOC Analytics (Patented) SSO repositories. Network identity is identified from important
Fortinet has developed an architecture that enables unified data network events. Then geo-identity is added to form a dynamic user
collection and analytics from diverse information sources including identity audit trail. This makes it possible to create policies or
logs, performance metrics, SNMP Traps, security alerts and perform investigations based on user identity instead of IP
configuration changes. FortiSIEM essentially takes the analytics addresses — allowing for rapid problem resolution.
traditionally monitored in separate silos from — SOC and NOC
— and brings that data together for a more holistic view of the Flexible and Fast Custom Log Parsing
security and availability of the business. Every piece of information Framework (Patented)
is converted into an event which is first parsed and then fed into Effective log parsing requires custom scripts but those can be slow
an event-based analytics engine for monitoring real-time searches, to execute, especially for high volume logs like Active Directory,
rules, dashboards and ad-hoc queries. firewall logs, etc. Compiled code on the other hand, is fast to
execute but is not flexible since it needs new software releases.
Distributed Real-Time Event Correlation Fortinet has developed an XML-based event parsing language that
(Patented) is functional like high level programming languages and easy to
Distributed event correlation is a difficult problem, as multiple nodes modify yet can be compiled during run-time to be highly efficient.
have to share their partial states in real time to trigger a rule. While All FortiSIEM parsers go beyond most competitor’s offerings using
many SIEM vendors have distributed data collection and distributed this patented solution and can be parsed at beyond 10K EPS per
search capabilities, Fortinet is the only vendor with a distributed node.
real-time event correlation engine. Complex event patterns can be
detected in real time. This patented algorithm enables FortiSIEM to Business Services Dashboard — Transforms
handle a large number of rules in real time at high event rates for System to Service Views
accelerated detection timeframes. Traditionally, SIEMS monitor individual components — servers,
applications, databases and so forth — but what most
Real-Time, Automated Infrastructure Discovery organizations really care about is the services those systems power.
and Application Discovery Engine (CMDB) FortiSIEM now offers the ability to associate individual components
Rapid problem resolution requires infrastructure context. Most log with the end user experience that they deliver together providing a
analysis and SIEM vendors require administrators to provide the powerful view into the true availability of the business.
context manually, which quickly becomes stale, and is highly prone
to human error. Fortinet has developed an intelligent infrastructure User and Entity Behavior Analysis
and application discovery engine that is able to discover and map Predefined correlation rules as well as more advanced machine
the topology of both physical and virtual infrastructure, on-premises learning help identify insider and incoming threats that pass
and in public/private clouds, simply using credentials without any traditional defenses. High fidelity alerts raise the profile of high
prior knowledge of what the devices or applications are. priority actions identified within the organization.

An up-to-date CMDB (Centralized Management Database) enables Automated Incident Mitigation

sophisticated context aware event analytics using CMDB Objects in When an Incident is triggered, an automated script can be run to
search conditions. mitigate or eliminate the threat. Built-in scripts support a variety of
devices including Fortinet, Cisco, Palo Alto and Window/Linux
Dynamic User Identity Mapping servers. Built-in scripts can execute a wide range of actions including
Crucial context for log analysis is connecting network identity
disabling a user’s Active Directory account, disabling a switch port,
(IP address, MAC Address) to user identity (log name, full name,
blocking an IP address on a Firewall, deauthenticating a user on a
organization role). This information is constantly changing as users
WLAN Access Point, and more. Scripts leverage the credentials
obtain new addresses via DHCP or VPN.
FortiSIEM already has in the CMDB. Administrators can easily
Fortinet has developed a dynamic user identity mapping methodology. extend the actions available by creating their own scripts.
Users and their roles are discovered from on-premises or Cloud

2 www.fortinet.com
 FortiSIEM
®

HIGHLIGHTS

Infusion of Security Intelligence Large Enterprise and Managed Service

FortiGuard Threat Intelligence and Indicators of Compromise (IOC) Provider Ready — “Multi-Tenant Architecture”
and Threat Intelligence (TI) feeds from commercial, open source Fortinet has developed a highly customizable, multi-tenant
and custom data sources integrate easily into the security TI architecture that enables enterprises and service providers to
framework. This grand unification of diverse sources of data manage a large number of physical/logical domains and over-
enables organizations to rapidly identify root causes of threats, and lapping systems and networks from a single console. In this
take the steps necessary to remediate and prevent them in the environment it is very easy to cross-correlate information across
future. Steps can often be automated with new Threat Mitigation physical and logical domains, and individual customer networks.
Libraries for many Fortinet products. Unique reports, rules and dashboards can easily be built for each,
with the ability to deploy them across a wide set of reporting
domains, and customers. Event archiving policies can also be
deployed on a per domain or customer basis. Granular RBAC
controls allow varying levels of access to Administrators and
Tenants/Customers.

FEATURES

Real-Time Operational Context for Rapid §§ Storage usage, performance monitoring — EMC, NetApp, Isilon,
Security Analytics Nutanix, Nimble, Data Domain
§§ Continually updated and accurate device context — §§ Specialized application performance monitoring
configuration, installed software and patches, running services §§ Microsoft Active Directory and Exchange via WMI and Powershell
§§ System and application performance analytics along with §§ Databases — Oracle, MS SQL, MySQL via JDBC
contextual inter-relationship data for rapid triaging of security §§ VoIP infrastructure via IPSLA, SNMP, CDR/CMR
issues §§ Flow analysis and application performance — Netflow, SFlow,
§§ User context, in real-time, with audit trails of IP addresses, user Cisco AVC, NBAR
identity changes, physical and geo-mapped location §§ Ability to add custom metrics
§§ Detect unauthorized network devices, applications, and §§ Baseline metrics and detect significant deviations
configuration changes
Availability Monitoring
Out-of-the-Box Compliance Reports §§ System up/down monitoring — via Ping, SNMP, WMI, Uptime
§§ Out-of-the-box pre-defined reports supporting a wide range of Analysis, Critical Interface, Critical Process and Service,
compliance auditing and management needs including — BGP/OSPF/EIGRP status change, Storage port up/down
PCI-DSS, HIPAA, SOX, NERC, FISMA, ISO, GLBA, GPG13, §§ Service availability modeling via Synthetic Transaction Monitoring
SANS Critical Controls — Ping, HTTP, HTTPS, DNS, LDAP, SSH, SMTP, IMAP, POP,
FTP, JDBC, ICMP, trace route and for generic TCP/UDP ports
Performance Monitoring §§ Maintenance calendar for scheduling maintenance windows
§§ Monitor basic system/common metrics §§ SLA calculation — “normal” business hours and after-hours
§§ System level via SNMP, WMI, PowerShell considerations
§§ Application level via JMX, WMI, PowerShell
§§ Virtualization monitoring for VMware, Hyper-V — guest, host,
resource pool and cluster level

3
FortiSIEM®

FEATURES

Real-Time Configuration Change Monitoring Notification and Incident Management

§§ Collect network configuration files, stored in a versioned §§ Policy-based incident notification framework
repository §§ Ability to trigger a remediation script when a specified
§§ Collect installed software versions, stored in a versioned incident occurs
repository §§ API-based integration to external ticketing systems —
§§ Automated detection of changes in network configuration and ServiceNow, ConnectWise, and Remedy
installed software §§ Built-in ticketing system
§§ Automated detection of file/folder changes — Windows and §§ Incident reports can be structured to provide the highest priority
Linux — who and what details to critical business services and applications
§§ Automated detection of changes from an approved §§ Trigger on complex event patterns in real time
configuration file
§§ Automated detection of windows registry changes via FortiSIEM Rich Customizable Dashboards
windows agent §§ Configurable real-time dashboards, with “Slide-Show” scrolling
for showcasing KPIs
Device and Application Context §§ Sharable reports and analytics across organizations and users
§§ Network Devices including Switches, Routers, Wireless LAN §§ Color-coded for rapidly identifying critical issues
§§ Security devices — Firewalls, Network IPS, Web/Email §§ Fast — updated via in-memory computation
Gateways, Malware Protection, Vulnerability Scanners §§ Specialized layered dashboards for business services, virtualized
§§ Servers including Windows, Linux, AIX, HP UX infrastructure, and specialized apps
§§ Infrastructure Services including DNS, DHCP, DFS, AAA,
Domain Controllers, VoIP External Threat Intelligence Integrations
§§ User-facing Applications including Web Servers, App Servers, §§ API’s for integrating external threat feed intelligence — Malware
Mail, Databases domains, IPs, URLs, hashes, Tor nodes
§§ Storage devices including NetApp, EMC, Isilon, Nutanix, §§ Built-in integration for popular threat intelligence sources —
Data Domain ThreatStream, CyberArk, SANS, Zeus
§§ Cloud Apps including AWS, Box.com, Okta, Salesforce.com §§ Technology for handling large threat feeds — incremental
§§ Cloud infrastructure including AWS download and sharing within cluster, real-time pattern matching
§§ Environmental devices including UPS, HVAC, Device Hardware with network traffic. All STIX & TAXII feeds are supported
§§ Virtualization infrastructure including VMware ESX, Microsoft
Hyper-V Scalable and Flexible Log Collection Powerful and Scalable Analytics
§§ Search events in real time— without the need for indexing
Scalable and Flexible Log Collection
§§ Keyword and event-based searches
§§ Collect, Parse, Normalize, Index and Store security logs at very
§§ Search historical events — SQL-like queries with Boolean filter
high speeds (beyond 10K events/sec per node)
conditions, group by relevant aggregations, time-of-day filters,
§§ Out-of-the-box support for a wide variety of security systems
regular expression matches, calculated expressions — GUI & API
and vendor APIs — both on-premises and cloud
§§ Use discovered CMDB objects, user/identity and location data
§§ Windows Agents provide highly scalable and rich event
in searches and rules
collection including file integrity monitoring, installed software
§§ Schedule reports and deliver results via email to key stakeholders
changes and registry change monitoring
§§ Search events across the entire organization, or down to a
§§ Linux Agents for file integrity monitoring
physical or logical reporting domain
§§ Modify parsers from within the GUI and redeploy on a running
§§ Dynamic watch lists for keeping track of critical violators — with
system without downtime and event loss
the ability to use watch lists in any reporting rule
§§ Create new parsers (XML templates) via integrated parser
§§ Scale analytics feeds by adding Worker nodes without downtime
development environment and share among users via
export/import function
§§ Securely and reliably collect events for users and devices
located anywhere

4 www.fortinet.com
 FortiSIEM ®

FEATURES

Baselining and Statistical Anomaly Detection Easy Scale Out Architecture

§§ Baseline endpoint/server/user behavior — hour of day and §§ Available as Virtual Machines for on-premises and public/private
weekday/weekend granularity cloud deployments on the following hypervisors — VMware ESX,
§§ Highly flexible — any set of keys and metrics can be “baselined” Microsoft Hyper-V, KVM, Amazon Web Services AMI,
§§ Built-in and customizable triggers on statistical anomalies OpenStack, Azure (only Collector)
§§ Multiple physical appliance models with varying levels of
External Technology Integrations performance to provide a variety of deployment options
§§ Integration with any external web site for IP address lookup §§ Scale data collection by deploying multiple Collectors
§§ API-based integration for external threat feed intelligence §§ Collectors can buffer events when connection to FortiSIEM
sources Supervisor is not available
§§ API-based 2-way integration with help desk systems — §§ Scale analytics by deploying multiple Workers
seamless, out-of-the box support for ServiceNow, ConnectWise §§ Built-in load balanced architecture for collecting events from
and Remedy remote sites via collectors
§§ API-based 2-way integration with external CMDB — out-of-the
box support for ServiceNow and ConnectWise FortiSIEM Windows Agents
§§ Kafka support for integration with enhanced Analytics Reporting Fortinet has developed a highly efficient agentless technology for
— i.e. ELK, Tableau and Hadoop collecting information. However some information, such as file
§§ API for easy integration with provisioning systems integrity monitoring data, is expensive to collect remotely. FortiSIEM
has combined its agentless technology with newly developed high
§§ API for adding organizations, creating credentials, triggering
performance agents to significantly bolster its data collection.
discovery, modifying monitoring events

AGENTLESS ADVANCED
Simple and Flexible Administration TECHNOLOGY AGENT
Agentless
§§ Web-based GUI
Discovery •
§§ Rich Role-based Access Control for restricting access to GUI Performance Monitoring •
and data at various levels (Low Performance) Collect System, App & Security Logs •
§§ All inter-module communication protected by HTTPS Agents
(High Performance) Collect System, App & Security Logs •
§§ Full audit trail of FortiSIEM user activity
Collect DNS, DHCP, DFS, IIS Logs •
§§ Easy software upgrade with minimal downtime & event loss Up to 10,000 Agents per Agent Manager •
§§ Rapid updates to Fortinet FortiSIEM knowledge base updates Local Parsing and Time Normalization •
(parsers, rules, reports) Installed Software Detection •
Registry Change Monitoring •
§§ Policy-based archiving
File Integrity Monitoring •
§§ Hashing of logs in real time for non-repudiation & integrity Customer Log File Monitoring •
verification WMI Command Output Monitoring •
PowerShell Command Output Monitoring •
§§ Flexible user authentication — local, external via Microsoft AD
and OpenLDAP, Cloud SSO/SAML via Okta
§§ Ability to log into remote server behind a collector from
FortiSIEM GUI via remote SSH tunnel

5
FortiSIEM ®

SPECIFICATIONS

FORTISIEM 500F FORTISIEM 2000F FORTISIEM 3500F

“COLLECTOR” “SUPERVISOR” “SUPERVISOR”
Hardware Specifications
CPU Intel Xeon E3-1225V3 4C4T Intel Xeon E5-2620V3 6C12T 2x Intel Xeon E5-2680V2 10C20T
3.20 GHz 2.40 GHz 2.80 GHz
Memory DDR3 16 GB (2x 8 GB) DDR4 32 GB (4x 8 GB) DDR3 64 GB (8x 8 GB)
Network Interfaces 4x GE RJ45 ports 4x GE RJ45 ports 2x GE RJ45 ports, 2x SFP ports
Console Port DB9 DB9 DB9
USB Ports 2x USB 2.0; 2x USB 3.0 2x USB 2.0; 2x USB 3.0 4x USB 2.0
Storage Capacity 3 TB (1x 3 TB) 36 TB (12x 3 TB) 72 TB (24x 3 TB)

Dimensions
Height x Width x Length (inches) 1.7 x 17.2 x 19.8 3.5 x 17.2 x 25.6 7 x 17.2 x 26
Height x Width x Length (mm) 43 x 437 x 503 89 x 437 x 648 178 x 437 x 660
Weight 31 lbs (14 kg) 58 lbs (26.3 kg) 93.74 lbs (42.5 kg)
Form Factor 1 RU 2 RU 4 RU

Environment
AC Power Supply 100–240V AC, 60–50 Hz 100–240V AC, 60–50 Hz 100–240V AC, 60–50 Hz
Power Consumption (Average / Maximum) 132.3 W / 150.3 W 285.7 W / 310.5 W 528 W / 586.6 W
Heat Dissipation 546.95 BTU/h 1093.55 BTU/h 2035.60 BTU/h
Operating Temperature 50–95°F (10–35°C) 50–95°F (10–35°C) 41–95°F (5–35°C)
Storage Temperature -40–158°F (-40–70°C) -40–158°F (-40–70°C) -40–140°F (-40–60°C)
Humidity 8–90% (non-condensing) 8–90% (non-condensing) 8–90% (non-condensing)

FortiSIEM 500F FortiSIEM 2000F FortiSIEM 3500F

6 www.fortinet.com
 FortiSIEM ®

ORDER INFORMATION

Licensing Scheme
FortiSIEM licenses provide the core functionality for cross-correlated analytic network device discovery. Devices include switches, routers,
firewalls, servers, etc. Each device that is to be monitored requires a license. Each license supports data capture and correlation, alerting
and alarming, reports, analytics, search and optimized data repository and includes 10 EPS (Events Per Second). “EPS” is a performance
measurement that defines how many messages or events are generated by each device in a second. Additional EPS can be purchased
separately as needed. Licenses are available in either a “Subscription” or “Perpetual” version.

PRODUCT SKU DESCRIPTION

FortiSIEM Hardware Product
FortiSIEM 500F FSM-500F FortiSIEM Collector Hardware Appliance FSM-500 supports up to 5K EPS, 500 SNMP, 200 WMI for Performance/100 WMI
for Logs.
FortiSIEM 2000F FSM-2000F FortiSIEM All-in-one Hardware Appliance FSM-2000F supports up to 15K EPS (all features turned on). Does not include any
device or EPS licenses which must be purchased separately.
FortiSIEM 3500F FSM-3500F FortiSIEM All-in-one Hardware Appliance FSM-3500F supports up to 30K EPS (all features turned on). Does not include any
device or EPS licenses which must be purchased separately.
FortiSIEM Base Product
FortiSIEM All-In-One Perpetual License FSM-AIO-BASE Base All-in-one Perpetual License for 50 devices and 500 EPS.
FSM-AIO-XX-UG Add XX devices and EPS/device All-in-one Perpetual License.
FortiSIEM All-In-One Perpetual License for FSM-2000F FSM-AIO-2000-BASE 100 devices and 1000 EPS All-in-one Perpetual License for FortiSIEM FSM-2000F. Does not include Maintenance & Support.
FortiSIEM All-In-One Perpetual License for FSM-3500F FSM-AIO-3500-BASE 500 devices and 5000 EPS All-in-one Perpetual License for FortiSIEM FSM-3500F. Does not include Maintenance & Support.
FortiSIEM All-In-One Subscription License FC1-10-FSM98-180-02-DD Per Device Subscription License that manages minimum XX devices, 10 EPS/device.
FortiSIEM Additional Products
FortiSIEM End-Point Device Perpetual License FSM-EPD-XX-UG Add XX End-Points and 2 EPS/End-Point for All-in-one Perpetual License
FortiSIEM End-Point Device Subscription License FC[1-8]-10-FSM98-184-02-DD Per End-Point Subscription License for minimum XX End-Points, 2 EPS/End-Point
Add 1 EPS Perpetual License FSM-EPS-100-UG Add 1 EPS Perpetual
Add 1 EPS Subscription License FC[1-10]-FSM98-183-02-DD Add 1 EPS Subscription
FortiSIEM Advanced Windows Agent Perpetual License FSM-WIN-ADV-XX-UG XX Advanced Windows Agents for Perpetual License
FortiSIEM Advanced Windows Agent Subscription License FC[1-8]-10-FSM98-182-02-DD Per Agent Subscription License for minimum XX Advanced Windows Agents
IOC Service Subscription License FC[1-G]-10-FSM98-149-02-DD (X Points) FortiSIEM Indicators of Compromise (IOC) Service. 1 device or 2 End-Points or 3 Windows Agents equals 1 point.
FortiSIEM Support
FortiCare Support for FortiSIEM FC[1-G]-10-FSM97-248-02-DD 24x7 FortiCare Contract (X Points). 1 device or 2 End-Points or 3 Windows Agents equals 1 point.
FC-10-FSM04-311-02-DD 8x5 FortiCare Contract
FC-10-FSM04-247-02-DD 24x7 FortiCare Contract

GLOBAL HEADQUARTERS EMEA SALES OFFICE APAC SALES OFFICE LATIN AMERICA SALES OFFICE
Fortinet Inc. 905 rue Albert Einstein 300 Beach Road 20-01 Sawgrass Lakes Center
899 KIFER ROAD 06560 Valbonne The Concourse 13450 W. Sunrise Blvd., Suite 430
Sunnyvale, CA 94086 France Singapore 199555 Sunrise, FL 33323
United States Tel: +33.4.8987.0500 Tel: +65.6395.2788 United States
Tel: +1.408.235.7700 Tel: +1.954.368.9990
www.fortinet.com/sales

Copyright© 2018 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other
product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect
performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product
will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in
Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and guarantees pursuant
hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
FST-PROD-DS-FSIEM FSIEM-DAT-R11-201804