FortiSIEM
Leistungsstarkes Security Information und Event Management (SIEM) mit Benutzer- und Entitätsverhaltensanalyse (UEBA)
2022 Gartner® Magic Quadrant™ für Security Information and Event Management (SIEM)
Überblick
Die digitale Transformation hat mittlerweile alle Branchen erfasst und führt zu einer rasant (und ständig) wachsenden Angriffsfläche, die das Security-Management zunehmend schwieriger gestaltet. Security-Teams ersticken in einer Flut von Alarmmeldungen und anderen Informationen von unzähligen Sicherheitsgeräten. Erschwerend kommt der Fachkräftemangel im Bereich Cyber-Security hinzu: Es fehlen qualifizierte Mitarbeiter, die Fehlalarme von ernsten Problemen unterscheiden können.
Infrastruktur, Anwendungen und Endpunkte (einschließlich IoT-Geräte) müssen zuverlässig geschützt werden. Das IT-Team benötigt dafür Transparenz über alle Geräte und die gesamte Infrastruktur – in Echtzeit. Und Unternehmen müssen genau wissen, welche Geräte eine Bedrohung darstellen und wo sich diese Geräte befinden.
Sortieren nach:
Ereignisse pro Sekunde |
5,000 |
Speicherkapazität |
3 TB |
Ereignisse pro Sekunde |
15,000 |
Speicherkapazität |
36 TB |
Ereignisse pro Sekunde |
40,000 |
Speicherkapazität |
96 TB |
Die virtuellen FortiSIEM-Maschinen laufen auf VMware vSphere, KVM, Microsoft Hyper-V und OpenStack.
Beschreibung |
50 devices and 500 EPS all-in-one perpetual license |
Beschreibung |
Add 25 devices and 250 EPS all-in-one perpetual license |
Beschreibung |
Add 50 devices and 500 EPS all-in-one perpetual license |
Beschreibung |
Add 100 devices and 1000 EPS all-in-one perpetual license |
Beschreibung |
Add 250 devices and 2500 EPS all-in-one perpetual license |
Beschreibung |
Add 450 devices and 4500 EPS all-in-one perpetual license |
Beschreibung |
Add 950 devices and 9500 EPS all-in-one perpetual license |
Beschreibung |
Add 1950 devices and 19500 EPS all-in-one perpetual license |
Beschreibung |
Add 3950 devices and 39500 EPS all-in-one perpetual license |
Beschreibung |
Add 4950 devices and 49500 EPS all-in-one perpetual license |
Die virtuellen FortiSIEM-Maschinen sind für Amazon Web Services (AWS) verfügbar.
FortiSIEM provides integration with many leading IT vendors as part of the Fortinet Security Fabric. Below is a list of current FortiSIEM Alliance Partners:
Amazon Web Services
AWS services are trusted by more than a million active customers around the world – including the fastest growing startups, largest enterprises, and leading government agencies – to power their infrastructures, make them more agile, and lower costs.
Learn more on the Fortinet-AWS alliance
ATAR Labs
ATAR Labs builds next-generation SOAR platform ATAR. Together with Fortinet, SOC teams become more agile and respond to complex threats and defend their infrastructure. Automatic processes deployed and orchestrated from ATAR, and enforcement, and detection from Fortinet creates an integrated operation to achieve a secure environment.
Brocade
Brocade networking solutions help the world's leading organizations turn their networks into platforms for business innovation. With solutions spanning public and private data centers to the wireless network edge, Brocade is leading the industry in its transition to the New IP network infrastructures required for today's era of digital business.
Cisco
Cisco is the worldwide leader in IT that helps companies seize the opportunities of tomorrow by proving that amazing things can happen when you connect the previously unconnected.
Citrix
Citrix is leading the transition to software-defining the workplace, uniting virtualization, mobility management, networking, and SaaS solutions to enable new ways for businesses and people to work better.
Claroty
Claroty's ICS Security Platform passively protects industrial networks and assets from cyberattack; ensuring safe and continuous operation of the worlds most critical infrastructures without compromising the safety and security of personnel or expensive industrial assets. 2018 S4 ICS Challenge winner!
CrowdStrike, Inc.
CrowdStrike has redefined security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity, and data.
CyberArk
CyberArk is the global leader in privileged account security, a critical layer of IT security to protect data, infrastructure and assets across the enterprise, in the cloud and throughout the DevOps pipeline. CyberArk delivers the industry’s most complete solution to reduce risk created by privileged credentials and secrets.
CyberX
CyberX delivers the only IIoT and ICS cybersecurity platform built by blue-team experts with a track record defending critical national infrastructure-and the only platform with patented ICS-aware threat analytics and machine learning. Together with Fortinet, CyberX reduces the time from ICS & IIoT threat detection to prevention.
CyGlass, Inc
CyGlass is an AI based SaaS security platform that uses network data to uncover, pinpoint, and respond to advanced cyber threats that have evaded traditional security controls.
Cynerio
The Cynerio-Fortinet joint solution equips healthcare IT security teams with comprehensive security and remediation policies that ensure uninterrupted clinical services. Armed with detailed insights into medical device behavior, impact, and criticality, hospitals can enforce customized cybersecurity policy using ACLs, VLANs, NAC and firewalls.
D3 Security
D3 Security's award-winning SOAR platform seamlessly combines security orchestration, automation and response with enterprise-grade investigation/case management, trend reporting and analytics. With D3's adaptable playbooks and scalable architecture, security teams can automate SOC use-cases to reduce MTTR by over 95%, and manage the full lifecycle of any incident or investigation.
DFLabs
DFLabs IncMan SOAR leverages existing security products to dramatically reduce the response and remediation gap caused by limited resources and the increasing volume of incidents. Together with Fortinet, IncMan allows joint customers to respond to security incidents in a faster, more informed and efficient manner.
Dragos
The Dragos mission is to safeguard civilization from those trying to disrupt the industrial infrastructure. Dragos provides solutions for asset identification, threat detection, and response with insights from industrial control systems (ICS) cybersecurity experts. Dragos works with Fortinet to provide increased visibility and improved correlation of cyber events. This helps customers evaluate and make better informed decisions when classifying events and required actions.
Endace
EndaceProbes record 100% accurate Network History to solve Cybersecurity issues. Together with Fortinet’s threat detection and response and Endace’s always-on network packet capture accelerates and simplifies security investigations and elevates SecOps threat hunting capabilities.
Entrust Datacard
Enable strong authentication for your Fortinet VPN and SIEM solutions with Entrust Datacard Identity. With cloud or on-premises deployment options, Entrust Datacard’s authentication solution integrates with Fortinet FortiGate VPN and FortiSIEM Server Agent using industry-standard protocols (Radius or SAML).
Flowmon
Flowmon Networks empowers businesses to manage and secure their computer networks confidently. Through high-performance network monitoring technology and lean-forward behavior analytics, IT pros worldwide benefit from absolute network traffic visibility to enhance network & application performance and deal with modern cyber threats. Flowmon complements Fortinet with network behavior analysis on east-west traffic while the integration with Fortinet keeps our mutual customers safe from advanced security threats.
Gigamon
Gigamon provides active visibility into physical and virtual network traffic, enabling stronger security, and superior performance.
Google Cloud Platform
Google Cloud Platform is a secure, dedicated public cloud computing service operated by Google which provides a range of infrastructure and application services that enable deployments in the cloud. Fortinet provides critical firewalling, advanced security and scalable BYOL protection for elastic compute, container, and machine-learning workloads in Google’s innovative public cloud.
IBM
IBM Security offers one of the most advanced and integrated portfolios of enterprise security products and services. The portfolio enables organizations to effectively manage risk and defend against emerging threats.
- IBM Security Alliance Overview
- Fortinet – IBM Security AppScan Solution Brief
- Fortinet – IBM Security QRadar Solution Brief
- Fortinet FortiGate and IBM QRadar Deployment Guide
- FortiGate App For IBM QRadar Technical Solution Guide
- Fortinet - IBM Resilient Technical Deployment Guide
- Fortinet - IBM Cloud Connector Solution Brief
- Fortinet FortiSOAR Connector for IBM QRadar
- IIoT World Webinar Recording
Industrial Defender
Industrial Defender ASM® solutions deliver cybersecurity, compliance and change management for Industrial Control Systems (ICS). Over the last decade, the organization has successfully developed and delivered a single unified platform to secure and manage heterogeneous control environments for critical infrastructure operations.
InfoBlox
Infoblox is leading the way to next-level DDI with its Secure Cloud-Managed Network Services. Infoblox brings next-level security, reliability and automation to cloud and hybrid systems, setting customers on a path to a single pane of glass for network management. Infoblox is a recognized leader with 50 percent market share comprised of 8,000 customers, including 350 of the Fortune 500.
IntSights
Revolutionizing cybersecurity with the first of its kind enterprise threat intelligence and mitigation platform that drives proactive defense by turning tailored threat intelligence into automated security action.
Keysight Technologies
Keysight is dedicated to providing tomorrow’s test technologies today, enabling our customers to connect and secure the world with their innovations. Together with Fortinet, Keysight enables visibility, security, and validation for Zero Trust environments.
Malware Patrol
Cyber security teams around the world rely on Malware Patrol's timely and actionable data to expand their threat landscape visibility and to improve detection rates and response times. Together we can improve the protection against malware, ransomware and phishing attacks by leveraging Fortinet's products and Malware Patrol's threat data.
Microsoft Azure
Microsoft is the leading platform and productivity company for the mobile-first, cloud-first world, and its mission is to empower every person and every organization on the planet to achieve more.
NetNumber
NetNumber is changing the future of Telco networks and services by delivering the industry’s only cloud-native software platform enriched with robust data sources and analytics. They enable network transformation from legacy (2G, 3G, 4G, LTE) to 5G and dramatically reduce cost structures and time to market for new services. The technological integration between Fortinet and NetNumber has provided a unique proposition by reducing the attack surface for fraudsters and scammers. The Fortinet and NetNumber Fabric-Ready Technology Partnership offer customers a combined solution where the whole really does become greater than the sum of its parts.
Nozomi Networks
Nozomi Networks is a leading provider of real-time visibility, advanced monitoring capabilities, and strong security for industrial control networks supporting critical infrastructure. Nozomi has been deployed in some of the largest industrial installations, providing some of the fastest return-on–investment in the industry.
- Solution brief
- Fortinet FortiGate and Nozomi Networks Guardian Deployment Guide
- Fortinet FortiSIEM and Nozomi Networks CMDB Deployment Guide
- ICS Security Overview & Integration Video
- Fortinet-Nozomi integration demo
OMICRON electronics GmbH
OMICRON threat detection and asset inventory solutions are tailor-made for the power grid and the engineers who keep it running safely and reliably. Fortinet and OMICRON join forces to secure the power grid from cyberattacks by providing solutions which are meeting all demands of the smart grid and are accessible by power engineers and IT security officers.
Oracle
Oracle offers a comprehensive and fully integrated stack of cloud applications and platform services.
OTORIO
RAM2 - OTORIO's Industrial-SOAR platform, designed for automation personnel operations and collaboration with the SOC's cyber experts. RAM2 offers centralized, simplified and automated industrial cyber risk preparedness and management solution. Based on attack vectors simulations and business impact risk engine the RAM2 provides smart mitigations to the operational environment and manufacturing processes.
Owl Cyber Defense
Network security is about trust. Trust in the assurance, expertise, and guidance to understand your requirements, identify the right solution, and support you from start to finish. Owl hardware-enforced cybersecurity and professional services, with Fortinet’s network and cloud security software, create a trusted, hardened barrier for your digital assets.
Pulse Secure
Pulse Secure enables seamless access to resources by combining visibility, authentication and context-based access control. This solution with Fortinet extends perimeter protection to all devices visible to the Secure Access solution while allowing access controls to respond to threat intelligence gathered by the Fortinet platform.
RAD Data Communications
RAD is a global Telecom Access solutions and products vendor, at the forefront of pioneering technologies. For critical infrastructure, our Service Assured Networking solutions include best-of-breed products for cyber-secure industrial IoT (IIoT) backhaul with edge/fog computing and seamless migration to modern packet-switched OT WANs.
Rubrik
Rubrik delivers a single platform to manage and protect data in the cloud, at the edge, and on-premises. Enterprises choose Rubrik’s Cloud Data Management software to simplify backup and recovery, accelerate cloud adoption, and enable automation at scale.
Safetica
Safetica Technologies delivers data protection solution for business. Safetica DLP (Data Loss Prevention) prevents companies from data breaches, teaches employees to care about sensitive data and makes data protection regulations easy to comply. Safetica integration with Fortinet technologies gives companies a powerful tool to secure all its´ data, no matter where it resides or flows.
SCADAfence
SCADAfence provides threat protection, risk management and visibility solutions for industrial OT networks. Combining SCADAfence’s dedicated solutions for OT networks with Fortinet’s Security Fabric, allows industrial organizations to effectively enforce security policies, improve incident response and extend their visibility from IT to OT.
Seclytics
Seclytics uses Science to predict where attacks will originate - on average 51 days before they strike - with over 97% accuracy and <.01 false positives. Together with Fortinet, we are able to report on and prevent attacks before adversaries strike.
SentinelOne
SentinelOne is shaping the future of endpoint security with an integrated platform that unifies the detection, prevention and remediation of threats initiated by nation states, terrorists, and organized crime. SentinelOne’s unique approach is based on deep inspection of all system processes combined with innovative machine learning to quickly isolate malicious behaviors, protecting devices against advanced, targeted threats in real time.
ServiceNow
ServiceNow makes work better. Our applications automate, predict, digitize and optimize business processes across IT, Customer Service, Security Operations, HR and more, for a better enterprise experience.
Symantec
Symantec Corporation (NASDAQ:SYMC), the world’s leading cyber security company, helps organizations, governments and people secure their most important data wherever it lives. The partnership with Fortinet combines Symantec’s endpoint protection leadership with Fortinet’s best-in-class network security and Fabric integration to deliver unparalleled security protection.
- Solution Brief
- Symantec CloudSOC Solution Brief
- Technical Deployment Guide
- Press Release on partnership
- Fabric Connector Technical Guide
Tanium
Tanium offers a proven platform for endpoint visibility and control that transforms how organizations manage and secure their computing devices with unparalleled speed and agility.
Tenable
Tenable®, Inc. is the Cyber Exposure company. Over 30,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. As the creator of Nessus®, Tenable extended its expertise in vulnerabilities to deliver the world’s first platform to see and secure any digital asset on any computing platform.
ThreatConnect
Designed by analysts but built for the entire team, ThreatConnect’s intelligence-driven security operations platform is the only solution available today with intelligence, automation, analytics, and workflows in a single platform.
ThreatQuotient
ThreatQuotient’s mission is to improve the efficiency and effectiveness of security operations through a threat-centric platform. Together with Fortinet, network defenders can make intelligence actionable by exporting data from ThreatQ into FortiGate firewalls to provide protection on the wire.
Trellix
Trellix brings you a living XDR architecture that adapts at the speed of threat actors and delivers advanced cyber threat Intelligence. Trellix and Fortinet's integrated solution secures distributed environments using the latest XDR tools to deliver faster detection and response time for optimum security outcomes.
Trend Micro
Trend Micro, a leader in cloud, endpoint, and email security, has partnered with Fortinet to help our mutual customers detect and respond to attacks more effectively throughout their organizations.
TriagingX
TriagingX provides automation of endpoint forensics, cutting advanced threat hunting time from hours to minutes. TXHunter analyzes Fortinet firewall log data and automatically launches forensic investigation on alerted endpoints. TXHunter enables FortiSIEM users to investigate sophisticated threats without leaving the platform. It's fast, efficient, and effective.
Tufin
Tufin leads the Security Policy Orchestration market, enabling enterprises to centrally manage, visualize, and control security policies across hybrid cloud and physical network environments.
Vectra AI
Vectra AI is the leading Cloud & Network Detection and Response (NDR) for your network, cloud, datacenter and SaaS applications. The Vectra platform blends security research with data science. Together with Fortinet, Vectra will automatically find and stop advanced attacks before they cause damage.
VMware
VMware is a global leader in cloud infrastructure and business mobility.
- NSX Solution Brief
- NFV Solution Brief
- NSX-T Solution Brief
- Carbon Black Solution Brief
- Carbon Black Technical Integration Guide
- Carbon Black Solution Video
Wandera
Wandera’s mobile security suite provides multi-level protection against cyber threats for users, endpoints, and corporate applications. Customers taking advantage of the technical alliance between Fortinet and Wandera can enforce policies that are consistent on both sides of the perimeter.
Ziften
Ziften simplifies endpoint protection.
The Zenith endpoint protection platform is a single product that stops cyber-attacks on all enterprise endpoints – laptops, desktops, servers, and cloud. The single agent deploys quickly and delivers (1) best-in-class zero-day protection, (2) complete investigation, (3) the most flexible response, plus (4) security posture analysis. The result is simplified endpoint protection to easily stop cyber-attacks with the people and budget you already have. Together with Fortinet, Ziften leverages the Fortinet Security Fabric to help customers better secure their endpoints, servers, and network.
Erfahren Sie in einer selbstgeführten Demo, wie FortiSIEM-Überwachungstools Ihnen helfen können, Sicherheitsbedrohungen zu erkennen, zu verhindern und auf sie zu reagieren.
Bitte füllen Sie das Formular aus, um eine FortiSIEM-Demo anzufordern.
FortiSIEM bietet moderne SIEM-Funktionen
FortiSIEM bietet Transparenz, Korrelation, automatisierte Reaktionen und Gegenmaßahmen in einer einzigen, skalierbaren Lösung. Das vereinfacht nicht nur das Management von Netzwerk- und Sicherheitsaktivitäten und entlastet Ihre Teams, sondern verbessert auch die Erkennung von Sicherheitsverletzungen bis hin zur proaktiven Verhinderung von Verstößen.
Unsere Architektur ermöglicht außerdem eine einheitliche Datenerfassung und -analyse aus unterschiedlichsten Informationsquellen – einschließlich Logs, Performance-Kennzahlen, Sicherheitswarnungen und Konfigurationsänderungen. FortiSIEM kombiniert die Analysen, die bislang in separaten SOC- und NOC-Bereichen isoliert erfolgten. Sie erhalten damit eine ganzheitlichere Sicht auf die Security und Ausfallsicherheit des gesamten Unternehmens.
Außerdem nutzt FortiSIEM UEBA maschinelles Lernen und statistische Methoden, um das normale Verhalten als Ausgangsbasis zu ermitteln und verwertbare Erkenntnisse über anomales Benutzerverhalten in Bezug auf geschäftskritische Daten in Echtzeit zu erhalten. Durch die Kombination von Telemetriedaten von Endpunkt-Sensoren, Datenflüssen über Netzwerk-Geräte, Cloud-APIs sowie Server- und Anwendungsprotokollen kann FortiSIEM umfassende Profile von Benutzern, Peergroups, Endgeräten, Anwendungen, Dateien und Netzwerken erstellen. Die Erkennung von Verhaltensanomalien mit FortiSIEM UEBA-Erkennung ist kostengünstig, ressourcenschonend und liefert aussagekräftige Daten. Dies sorgt für Transparenz auf ganzer Linie: über End-to-End-Aktivitäten von Endgeräten, On-Premises-Server und Netzwerk-Aktivitäten bis hin zu Cloud-Anwendungen.
Weitere Ressourcen zum Thema
Detect and Respond To Insider Threats: Fortinet FortiSIEM With User and Entity Behavior Analytics
Jetzt lesen
Recognizing the Many Faces of Insider Threats
Jetzt lesenWesentliche Vorteile von FortiSIEM
Eine moderne SIEM-Lösung kann mehr als nur Sicherheitsereignisse aggregieren. FortiSIEM bietet einen führenden Schutz vor Bedrohungen, von dem jedes Unternehmen stark profitiert. Zu den wichtigsten Vorteilen gehören:
Anpassbare Architektur und Lizenzierung, die mit Ihrem Unternehmen mitwächst
FortiSIEM bietet eine VM-Architektur* und Lizenzoptionen, die eine schnelle Skalierung ermöglichen.
- Einfaches Hinzufügen weiterer virtueller Maschinen (VMs) für mehr Performance und Log-Verarbeitungskapazitäten
- Kein Aufpreis für das Hinzufügen von VMs
- Flexible Lizenzoptionen: nutzungsbasierte Abrechnung mit MSSP PAYG, Abonnement oder unbefristete Lizenz
Einheitliche Plattform
Reduzieren Sie die Komplexität mit einer mandantenfähigen Lösung und Unterstützung mehrerer Anbieter.
- Mandantenfähigkeit mit einer einzigen Plattform: MSSPs können alle Kunden zentral verwalten und gleichzeitig die Gesamttransparenz gewährleisten. FortiSIEM unterstützt dies mit einer
- anpassbaren, mandantenfähigen grafischen Benutzeroberfläche (GUI),
- einer mandantenfähigen Datenbank und einer
- skalierbaren, mandantenfähigen Architektur.
- FortiSIEM unterstützt Hunderte Produkte von Drittanbietern und ermöglicht eine nahtlose Integration mit Fortinet-Produkten.
Zentrale Konsole und Kontrolle
Die meisten FortiSIEM-Funktionen – einschließlich Dashboards, Analysen, Incident-Management, Konfigurations-Management-Datenbank (CMBD) und Administration – sind über eine intuitive, webbasierte Benutzeroberfläche verfügbar.
- Mit der anpassbaren rollenbasierten Zugangskontrolle können Unternehmen bestimmen, auf was jeder Benutzer zugreifen darf.
- Active Asset Discovery hilft beim Aufbau einer integrierten CMBD für ein besseres Asset Management.
- Performance- und Verfügbarkeitsüberwachung – z. B. Änderungen bei CPUs, Arbeitsspeicher, Speicherkapazität oder Konfigurationen – erweitern die Funktionalität der Plattform und liefern zusätzliche Kontextdaten.
Bessere Erkennung von Vorfällen, damit Sicherheitsprobleme weniger Folgen haben
Mit FortiSIEM lassen sich externe und interne Bedrohungen schneller erkennen, Bedrohungen gezielt aufspüren und ein Compliance-Monitoring realisieren.
- Die Zeit bis zur Erkennung von Vorfällen wird mit einer patentierten, dezentralen Korrelations-Engine reduziert.
- Zu den sofort einsatzbereiten Security-Tools gehören vorkonfigurierte Parser, Dashboards und Berichte, die gängige Geräte abdecken und einen schnellen geschäftlichen Nutzen bieten.
- FortiSIEM Analytics hilft bei der Suche nach Bedrohungen und Indicator of Compromise (IOC).
- Insider-Bedrohungen werden mit FortiSIEM UEBA mit Endgeräte-Agenten identifiziert, die Telemetriedaten zum Verhalten liefern.
- Die durchschnittliche Reaktionszeit (MTTR) wird insgesamt verkürzt.
Einfachere Compliance und schnellere Rendite mit vorkonfigurierten Berichten und Tools
Die Fortinet-Lösung rechnet sich schnell, weil sie mehr Effizienz, weniger Risiko, geringere Auswirkungen durch Angriffe und eine einfachere Compliance ermöglicht.
- Die Effizienz von Mitarbeitern und Analysten steigt, da sie die richtigen Informationen und Erkennungsmeldungen erhalten.
- Risiken sind dank der Erkennung und Meldung von Sicherheitsvorfällen besser abschätzbar.
- Vorkonfigurierte FortiSIEM-Compliance-Berichte helfen Unternehmen dabei, die Konformität zu gewährleisten.
- Vordefinierte Inhalte führen zu einer schnelleren Amortisierung: Unterstützt werden über 750 Regeln, rund 3000 Berichte, vordefinierte Dashboards und mehr als 200 Geräte von Drittanbietern.
- Security-Teams können Business-Dienste definieren, um die Auswirkungen von Vorfällen besser zu erfassen. So ist genau ersichtlich, welcher Business-Dienst von einem Vorfall betroffen ist.
Mitarbeiter-Schulungen: Cyber-Sicherheit in der Praxis
Fortbildungen für Sicherheitsexperten, technische Trainings für IT-Fachkräfte und Schulungen für Homeoffice-Mitarbeiter zur Stärkung des Sicherheitsbewusstseins.
Mehr erfahren
