FSM-3500G -- FORTISIEM ALL-IN-ONE HARDWARE APPLIANCE FSM-3500G. SUPPORTS UP TO 30,000 EPS. DO

• Distributed Real-Time Event Correlation (Patented)
• Real-Time, Automated Infrastructure Discovery and Application Discovery Engine (CMDB)
• Dynamic User Identity Mapping
• Flexible and Fast Custom Log Parsing Framework (Patented)
• Business Services Dashboard - Transforms System to Service Views
• Automated Incident Mitigation
• Infusion of Security Intelligence

Fortinet has developed an architecture that enables unified data collection and analytics from diverse information sources including logs, performance metrics, SNMP Traps, security alerts, and configuration changes. FortiSIEM essentially takes the analytics traditionally monitored in separate silos - SOC and NOC - and brings that data together for a comprehensive view of the security and availability of the business. Every piece of information is converted into an event which is first parsed and then fed into an event-based analytics engine for monitoring real-time searches, rules, dashboards, and ad-hoc queries.
FortiSIEM uses Machine Learning to detect unusual user and entity behavior (UEBA) without requiring the Administrator to write complex rules. FortiSIEM helps identify insider and incoming threats that would pass traditional defenses. High fidelity alerts help prioritize which threats need immediate attention.
FortiSIEM build a risk scores of Users and Devices that can augment UEBA rules and other analysis. Risk scores are calculated by combining several datapoints regarding the user and device. The User and Device risk scores are displayed in a unified entity risk dashboard.

• Distributed Real-Time Event Correlation (Patented)
  Distributed event correlation is a difficult problem, as multiple nodes have to share their partial states in real time to trigger a rule. While many SIEM vendors have distributed data collection and distributed search capabilities, Fortinet is the only vendor with a distributed real-time event correlation engine. Complex event patterns can be detected in real time. This patented algorithm enables FortiSIEM to handle a large number of rules in real time at high event rates for accelerated detection timeframes.
• Real-Time, Automated Infrastructure Discovery and Application Discovery Engine (CMDB)
  Rapid problem resolution requires infrastructure context. Most log analysis and SIEM vendors require administrators to provide the context manually, which quickly becomes stale, and is highly prone to human error. Fortinet has developed an intelligent infrastructure and application discovery engine that is able to discover both physical and virtual infrastructure, on-premises and in public/ private clouds, simply using credentials without any prior knowledge of what the devices or applications are. An up-to-date CMDB (Centralized Management Database) enables sophisticated context aware event analytics using CMDB Objects in search conditions.
• Dynamic User Identity Mapping
  Crucial context for log analysis is connecting network identity (IP address, MAC Address) to user identity (log name, full name, organization role). This information is constantly changing as users obtain new addresses via DHCP or VPN. Fortinet has developed a dynamic user identity mapping methodology. Users and their roles are discovered from on-premises or Cloud SSO repositories. Network identity is identified from important network events. Then geo-identity is added to form a dynamic user identity audit trail. This method makes it possible to create policies or perform investigations based on user identity instead of IP addresses - allowing for rapid problem resolution.
• Flexible and Fast Custom Log Parsing Framework (Patented)
  Effective log parsing requires custom scripts but those can be slow to execute, especially for high volume logs like Active Directory and firewall logs. Compiled code on the other hand, is fast to execute but is not flexible since it needs new software releases. Fortinet has developed an XML-based event parsing language that is functional like high level programming languages and easy to modify yet can be compiled during run-time to be highly efficient. All FortiSIEM parsers go beyond most competitor's offerings using this patented solution and can be parsed at beyond 10K EPS per node.
• Business Services Dashboard - Transforms System to Service Views
  Traditionally, SIEMS monitor individual components - servers, applications, databases, and so forth - but what most organizations really care about is the services those systems power. FortiSIEM now offers the ability to associate individual components with the end user experience that they deliver together providing a powerful view into the true availability of the business.
• Automated Incident Mitigation
  When an Incident is triggered, an automated script can be run to mitigate or eliminate the threat. Built-in scripts support a variety of devices including Fortinet, Cisco, Palo Alto, and Window/Linux servers. Built-in scripts can execute a wide range of actions including disabling a user's Active Directory account, disabling a switch port, blocking an IP address on a Firewall, deauthenticating a user on a WLAN Access Point, and more. Scripts leverage the credentials FortiSIEM already has in the CMDB. Administrators can easily extend the actions available by creating their own scripts.
• Infusion of Security Intelligence
  FortiGuard Threat Intelligence and Indicators of Compromise (IOC) and Threat Intelligence (TI) feeds from commercial, open source, and custom data sources integrate easily into the security TI framework. This grand unification of diverse sources of data enables organizations to rapidly identify root causes of threats, and take the steps necessary to remediate and prevent them in the future. Steps can often be automated with new Threat Mitigation Libraries for many Fortinet products.