FortiAnalyzer is Fortinet's centralized log management and security analytics platform. It collects logs from FortiGate firewalls, FortiAP access points, FortiSwitch, and other Fortinet Security Fabric devices, then correlates events, generates compliance reports, and surfaces threat intelligence in a single dashboard. Security teams use it to investigate incidents faster, satisfy audit requirements, and track network behavior across the entire Fortinet environment.

FortiAnalyzer collects and analyzes logs from FortiGate (all models and generations), FortiProxy, FortiAP, FortiSwitch, FortiMail, FortiWeb, FortiClient, FortiAuthenticator, and other Fortinet Security Fabric components. It is designed specifically to work within the Fortinet ecosystem and integrates natively with FortiManager, FortiSIEM, and FortiSOAR.

FortiGate logs events locally and offers its own dashboard, but local storage is limited and historical analysis across multiple firewalls is difficult without a dedicated log management tool. FortiAnalyzer gives you centralized, long-term storage, cross-device correlation, forensic search, and compliance-ready reports that FortiGate alone cannot produce. If you run more than one FortiGate, or if you need to retain logs for compliance, FortiAnalyzer is worth the investment.

The G series (150G, 300G, 800G, 3000G, 3500G, 3700G) is the current hardware generation, built for higher throughput, larger storage capacities, and support for the latest FortiOS versions. The F series (800F, 1000F, 3000F, BigData-4500F) is the previous hardware generation and remains fully supported and available. Most new deployments should start with the G series unless budget or an existing F-series environment drives the decision otherwise.

Yes. FortiAnalyzer VM runs on VMware ESXi, Microsoft Hyper-V, KVM, and AWS or Azure environments. It provides the same log collection, analytics, and reporting features as a physical appliance. VM capacity is license-based and scales with the number of managed devices and daily log ingestion volume. Our engineers can help you determine the correct license tier before you order.

The two key variables are the number of managed Fortinet devices and the average gigabytes of logs your environment generates per day. A small office with two or three FortiGates fits comfortably on a 150G. Mid-size companies managing 50 to 150 devices typically need an 800G. Large enterprises and MSSPs managing hundreds or thousands of devices should look at the 3000 series or BigData-4500F. Tell our team your device count and we will recommend the right model.

Yes. FortiAnalyzer supports administrative domains (ADOMs), which let MSSPs or large enterprises segment log data and reports by customer or business unit. Each ADOM can have its own administrators, report schedules, and data retention policies. The BigData-4500F and the high-end 3000 series appliances are built specifically for MSSP-scale multi-tenant deployments.

FortiAnalyzer integrates directly with both. FortiSIEM can pull event data from FortiAnalyzer for broader correlation across non-Fortinet sources. FortiSOAR can consume FortiAnalyzer alerts to trigger automated playbooks for incident response. These integrations are native to the Fortinet Security Fabric and require no third-party connectors or custom development.