Fortinet FortiAnalyzer 150G Appliance

Fortinet FortiAnalyzer 150G Appliance (FAZ-150G) — Product Description

The FortiAnalyzer 150G is a centralized logging, analytics, and security operations appliance designed to give small-to-mid environments a single, on-prem platform for unified visibility, threat detection, and workflow automation. Acting as the data lake for the Fortinet Security Fabric, the FAZ-150G aggregates and normalizes telemetry from Fortinet devices (and supported third-party sources), enriches events with FortiGuard threat intelligence, and delivers actionable insights through dashboards, reports, correlation rules, and automated response workflows.

Built for plug-and-play SecOps, FortiAnalyzer 150G combines core SIEM and SOAR capabilities in one appliance—helping lean IT and security teams reduce tool sprawl, improve detection speed, and standardize incident response. It also supports a built-in Generative AI assistant (via FortiAI subscription) to accelerate triage and investigations using natural-language queries.

Model snapshot (FAZ-150G)

• Centralized log and analysis appliance with 2x RJ45 GE and 4 TB raw storage (2x 2TB)

• Up to 25 GB/day log capacity

• Performance guidance: ~500 logs/sec sustained analytics, ~750 logs/sec sustained collector

• Supports up to 50 devices/VDOMs

• Up to ~90 days of analytics retention under sustained-rate assumptions (varies with log volume)

Key capabilities

Centralized log collection and unified visibility

• Consolidates logs and telemetry across network, security, endpoint, and cloud layers into a single, searchable repository.

• Supports ingestion methods such as syslog, APIs, alert ingestion services, and agent-based forwarding (e.g., FortiClient).

• Role-based access control and data retention policies support operational governance and compliance needs.

Built-in SIEM analytics and event correlation

• Correlates events across multiple sources to detect threats that may appear benign in isolation.

• Enables faster identification of lateral movement, account compromise, suspicious traffic patterns, and coordinated activity across the environment.

• Includes event handlers and correlation logic to improve detection fidelity and reduce noise.

SOAR-style automation and response workflows

• Automates repetitive SOC tasks such as alert handling, notifications, ticketing, and standardized response actions.

• Supports playbooks and automation hooks that can trigger enforcement through integrated controls (depending on connected Fabric components).

Threat intelligence enrichment with FortiGuard

• Enriches detections and investigations with current threat intelligence context (IOC feeds, reputation lookups, outbreak alerting via subscriptions).

• Improves confidence and speed when validating malicious indicators and prioritizing response.

Prebuilt dashboards, reports, and compliance outputs

• Provides prebuilt operational dashboards and reporting for technical teams and executives.

• Supports compliance-oriented reporting (examples referenced include PCI-DSS and HIPAA) and customizable reporting for audit readiness.

Monthly SOC automation content packs (FortiGuard Labs)

• Regularly updated content packs can include log parsers, reports, correlation rules, event handlers, and playbooks.

• Accelerates onboarding of new log sources and helps maintain detection coverage as threats evolve.

Generative AI assistance (with FortiAI subscription)

• Natural-language exploration of logs and alerts to speed up investigations without requiring deep query expertise.

• Helps summarize incidents, generate investigation narratives, and assist with report creation and operational tasks inside FortiAnalyzer.

Common use cases

Security Operations (SOC)

• Threat detection and hunting: Correlate events and search across centralized logs to uncover suspicious patterns and emerging threats.

• Alert triage and prioritization: Reduce analyst fatigue by normalizing alerts, enriching context with threat intel, and focusing attention on high-risk activity.

• Incident investigation: Build timelines, pivot across users/hosts/IPs, and quickly assemble evidence for containment and post-incident review.

• Response automation: Trigger consistent actions through playbooks (block/contain/notify/ticket) to shorten time to contain and reduce manual effort.

• Security reporting: Generate scheduled operational and executive reports, plus evidence outputs for security governance and audits.

Network Operations (NOC) and IT Operations

• Network & application monitoring: Central visibility into firewall, router, server, and application logs for performance and health signals.

• Troubleshooting and root-cause analysis: Real-time search and dashboards to speed investigation of outages, connectivity issues, and anomalous behavior.

• Capacity and trend reporting: Track system/resource trends (disk, memory, traffic indicators) to support planning and budgeting.

• Low-cost log forwarding: Retain and analyze logs locally, while forwarding a filtered subset to an external SIEM to manage ingestion costs.

View data sheet: FortiAnalyzer Data Sheet