Fortinet FortiAnalyzer 810G Appliance

Fortinet FortiAnalyzer 810G Appliance (FAZ-810G) — Product Description

The FortiAnalyzer 810G is a high-capacity, rackmount security analytics and centralized logging appliance designed to modernise security operations with a unified data lake, built-in SIEM and SOAR capabilities, and automation at scale. As the data lake of the Fortinet Security Fabric, FortiAnalyzer consolidates telemetry across network, endpoint, and cloud environments—ingesting Fortinet and third-party logs, normalising and enriching events with AI/ML analytics, and applying FortiGuard threat intelligence to improve detection and response.

The 810G model is suited to organisations that have outgrown entry-level log management and need higher ingestion capacity, more devices supported, and stronger performance for sustained analytics and incident investigation. It provides structured dashboards and reporting for SOC and operational teams, continuously updated SOC Automation content packs, and optional Generative AI assistance through FortiAI to speed up triage, investigation, and analyst workflows.

---

Key capabilities

Unified security data lake and centralised visibility

• Aggregates logs and telemetry from Fortinet products and supported third-party systems into a single platform.

• Delivers unified visibility across networks, endpoints, applications, and cloud layers to reduce blind spots.

• Supports multiple ingestion methods including syslog, APIs, alert ingestion, and agent-based forwarding (e.g., FortiClient).

• Role-based access control and data retention policies support operational governance and compliance requirements.

Advanced analytics, correlation, and detection

• Correlates activity across Security Fabric components to identify multi-stage attacks and suspicious patterns that appear unrelated in isolation.

• AI/ML-driven analytics enhance signal quality and provide context-rich detection for faster decision-making.

• Event handlers, correlation rules, and playbooks reduce manual effort and improve time-to-detect and time-to-respond.

Built-in threat intelligence enrichment (FortiGuard)

• Enriches events with real-time context using FortiGuard threat intelligence feeds.

• Subscription services can extend capabilities with Indicators of Compromise (IOC) and outbreak detection to support proactive hunting and faster outbreak response.

SIEM and SOAR in one platform

• Provides the operational foundation for a modern SOC: detection logic, investigation workflows, and response automation without stitching multiple tools together.

• Automation supports alert handling, escalation, ticketing, and notifications to reduce SOC fatigue and improve consistency.

Reporting, dashboards, and compliance visibility

• Prebuilt dashboards and reports support both technical and executive stakeholders.

• Custom reporting supports audit and compliance workflows (for example PCI-DSS and HIPAA) and helps teams demonstrate controls through log evidence.

SOC automation content packs (monthly updates)

• Regularly updated packs from FortiGuard Labs provide prebuilt use-cases including log parsers, reports, correlation rules, event handlers, and automated playbooks.

• Speeds onboarding of new log sources and improves readiness for emerging threats.

Generative AI assistant (optional via FortiAI subscription)

• Enables natural-language interaction to explore logs, summarise incidents, and accelerate investigations.

• Reduces reliance on deep query expertise by assisting with analysis, reporting, and threat hunting workflows.

---

Common use cases

Security Operations (SOC)

• Threat detection and correlation across network, endpoint, and cloud telemetry.

• Alert triage and prioritisation using enrichment, correlation, and automation to reduce noise.

• Incident investigation with timeline building, related-event analysis, and attack-path context from unified logs.

• Response automation to accelerate containment actions through integrated enforcement points in the Fortinet ecosystem.

• Threat hunting and retrospective analysis using IOC enrichment and historical log rescan.

Network and IT Operations

• Centralised monitoring of network and application events for troubleshooting and service assurance.

• Faster root-cause analysis through real-time search and operational dashboards.

• Capacity planning using trend reports (storage, log rates, performance signals).

• Cost optimisation by retaining and analysing high-volume logs locally, while forwarding filtered subsets to other platforms when needed.

---

Model snapshot (FAZ-810G)

• Form factor: 1RU rackmount

• Interfaces: 4x GE RJ45 + 2x GE SFP

• Storage: 16 TB self-encrypting storage (4x 4TB), ~8 TB usable after RAID

• Log ingestion: up to 200 GB/day

• Sustained analytics performance: ~4000 logs/sec

• Sustained collector performance: ~6000 logs/sec

• Scale: up to 800 devices/VDOMs

• Analytics retention guidance: up to ~50 days under sustained-rate assumptions (varies with average log volume)

View data sheet: FortiAnalyzer Data Sheet