Fortinet FortiSIEM Cloud

My main use case for Fortinet FortiSIEM  is building a SOC and serving as an event management platform for correlating events in my work.

I use Fortinet FortiSIEM  for event correlation by building a SOC for many customers, allowing the SOC team to rely on SIEM  technology to correlate and manage events from all security products.

The best features Fortinet FortiSIEM offers are reliability and scalability.

Reliability and scalability have helped me in my work, especially because the license for Fortinet FortiSIEM is excellent from a cost perspective, and we can add more collectors as we expand.

Fortinet FortiSIEM has positively impacted my organization by allowing us to manage our security and build our SOC.

Fortinet FortiSIEM is great overall. Performance could be enhanced, but I do not wish to elaborate on needed improvements.

I have been using Fortinet FortiSIEM for five years.

Fortinet FortiSIEM is stable.

Fortinet FortiSIEM's scalability is excellent, and it is also easy to configure, maintain, and operate.

The customer support for Fortinet FortiSIEM is excellent. I have interacted with their support team, and Fortinet's support is known to be wonderful.

I previously used IBM QRadar  as a different solution.

I have seen a return on investment that is excellent. The platform has resulted in time saved and reduces mean time to response, making it a great platform.

My experience with pricing, setup cost, and licensing for Fortinet FortiSIEM is wonderful, as it offers an excellent license compared to other vendors.

Before choosing Fortinet FortiSIEM, I evaluated IBM QRadar  as another option.

My advice for others looking into using Fortinet FortiSIEM is that it is better to use Fortinet FortiSIEM for building your SOC and maintaining your incident response at the SOC. I have provided this review with a rating of 10.

I have a lot of experience working with solutions such as Fortinet FortiSIEM , FortiSOAR , and FortiGate . I have also worked with ImmuniWeb . However, I did not have the credentials or the software to work with ImmuniWeb , which is why I was searching for more information on the website to learn more about the tool.

In the company I work for, we have a partnership with Fortinet.

In my organization, I work on Fortinet FortiSIEM  in the cloud.

Fortinet FortiSIEM is really user-friendly. You can filter easily, find rules, and even create new rules. I appreciate Fortinet FortiSIEM the most because it is easy to search, filter, make rules, and look for correlations and events.

For Fortinet FortiGate , it is easy to navigate through the tool itself, make policies, and look at events and logs. It is very easy to monitor on Fortinet FortiGate. I really appreciate it and believe anyone in the field can work with it easily.

For FortiSOAR , it is easy to work with playbooks and rules for approvals, and everything there is straightforward. Fortinet FortiSIEM pulls the events from FortiSOAR, processes them, and applies the playbooks. It is simple in its functions, has correlations, and offers everything needed.

I can find everything I need on Fortinet FortiSIEM. The filters, trends, and dashboard make it easy to use. The database, alerts, and customer service are excellent as well.

Regarding Fortinet FortiSIEM, I cannot identify any specific areas for improvement because I can find everything I need. For the time being, I cannot find a real point for improvement. Everything is working great on Fortinet FortiSIEM.

I have experience with Fortinet FortiSIEM for almost six months.

For Cortex XDR  from Palo Alto, it rates 10 out of 10. Everything is excellent with XDR  and the technical support is exceptional.

I have worked with Splunk and QRadar SIEM  tools, but I prefer Fortinet FortiSIEM the most.

I am not familiar with the price and cost of Fortinet FortiSIEM. I cannot tell you if it is high, expensive, or low. However, I can say that it is cost-effective as it provides everything needed.

I do not have relevant experience with tools such as Acunetix , Synopsys, Invicti , Snyk , Prolexic , AWS Shield , or Global Accelerator.

I wish to remain anonymous, with no names for my company or myself. I prefer written communication rather than voice-based.

Based on my experience, I would rate this solution 9 or 10 out of 10.

My primary use case for Fortinet FortiSIEM  is systems monitoring and alerting. I use it for standard functions like log monitoring, incident detection, and notification.

My customers are mostly medium-sized enterprises ranging from engineering companies, mining companies, independent schools, and government departments to agencies.

Fortinet FortiSIEM  is valuable mainly for its features around firewall monitoring, intrusion detection, and authentication. It provides extensive logging and record-keeping for internal networks, cloud applications, and services as well as perimeter physical network security. Compliance management capabilities, although limited, are utilized by mature customers for reporting.

The built-in APIs in Fortinet FortiSIEM are somewhat lacking and could be improved for better integration with external ITSM  products. Improving software stability and reducing bugs will make it a better tool for future use. Enhancing the completeness of its APIs could aid in better external integrations.

I have used Fortinet FortiSIEM for three and a half years to nearly four years.

The product has some instability and bugs, which are not service-stopping but may cause unusual errors and user interface issues. I regularly work with Fortinet support to address these issues.

Fortinet FortiSIEM is highly scalable. I would rate its scalability nine out of ten.

The customer support from Fortinet is good. There is a knowledgeable, though small, team of support engineers around the world. I have come to know them all by name.

From a new user's perspective, setting up Fortinet FortiSIEM could be rated as a five or six out of ten. However, with my four years of experience, I would rate the setup an eight out of ten.

Many of my customers are happy and have provided positive reviews about their experiences. They continue to pay for services and see value in the investment.

As a service, the cost is reasonable and affordable with scalable pricing based on the number of monitored devices. However, setting it up for oneself as an enterprise-licensed product can be quite expensive.

If you want to set it up yourself, seek expert support before starting. If considering a service, contact Fortinet for a recommended service provider in the FortiSIEM space.

I'd rate the solution eight out of ten.

Mainly, we are configuring various correlation rules in FortiSIEM  to detect various types of cyber threats and cybersecurity attacks, particularly brute force attacks, denial of service attacks, and distributed denial. We are using it to identify suspicious activities by internal staff as well as outsiders, for any type of intrusion.

The most fascinating aspect of FortiSIEM  is its integration with the MITRE ATT&CK framework. It maps threat vectors and IOCs on the MITRE framework to identify the kind and magnitude of a threat and the techniques used. This allows us to take requisite measures using the SOAR  solution or by involving our team of SOC analysts and incident responders.

FortiSIEM is a bit resource-hungry, so work should be done on hardware resource utilization to consume less hardware. Another major problem is its licensing model, which initially required separate licenses for devices, agents, and EPS.

Recently, they revised it to a subscription-based, all-inclusive license. There is also some latency observed in generating correlation alerts, which should be improved for quicker responses.

We have been using it for almost one year.

FortiSIEM is a reliable product. Multiple times, the server abruptly shut down, but no critical or major issues were observed after power outages. It stabilizes itself in an appropriate time, so its uptime is good.

FortiSIEM is a scalable model. At any point in time, when network devices increase or there is a change in the infrastructure, we can add more workers and collectors to expand our infrastructure setup.

Technical support in my city, specifically in Islamabad or Rawalpindi, is decent. I would rate it seven out of ten.

Local tech support is available, however, for more critical or technical issues, we depend on the OEM directly, especially when it comes to on-prem solutions.

The initial installation requires some tech knowledge. You should have prior understanding of modules, collectors, workers, supervisors, and databases. However, after installation, it's really easy to operate.

Fortinet FortiSIEM is high-priced. Previously, its licensing model required separate licenses for devices, agents, and EPS, which was quite rigid. The revised model is subscription-based and more flexible.

Compared to FortiSIEM, LogRhythm  is a good competitor. QRadar  is also a nice product, working equally well in our region.

I would rate FortiSIEM eight out of ten. It's a nice product and is used by major governmental infrastructures and organizations. I would definitely recommend it to other users.