Network Detection and Response

FortiNDR identifies cybersecurity incidents in progress based on anomalous network activity, speeding incident investigation and response

Download Solution Brief

Overview

FortiNDR enables full-lifecycle network protection, detection, and response. It provides security teams with network traffic and file-based analysis, along with root-cause identification, scope of incidents, and the ability to remediate quickly. The foundation of FortiNDR is robust artificial intelligence, complemented by pragmatic analytics and threat intelligence. Organizations can choose a self-contained, on-premises deployment powered by our Virtual Security Analyst with FortiNDR, or a guided SaaS with FortiNDR Cloud maintained by FortiGuard advanced threat experts.

Security Analyst On Demand

Given the sophistication of cyberthreat activity and the volume of legitimate activity within which it attempts to hide, Fortinet leverages artificial intelligence to replicate the time-intensive tasks of an experienced SOC analyst. A machine learning model establishes baselines of normal network activity and identifies deviations from that norm. It will also classify code associated with such abnormal traffic and perform an outbreak search to scope potential incidents. Integrated with other security controls, response actions can be automated.

Watch Now

video virtual security analyst revolutionizes threat protection fortindr

High-Fidelity Detection and Response

Fortinet has been using AI to fight cybercriminals for more than a decade—most notably in threat detection. FortiNDR uses ML and deep learning (DL) to identify malicious network activity and files, resulting in the real-time identification of advanced threats, including zero-day attacks. To achieve a proactive security posture, leveraging these security technologies is required to stop advanced attacks. FortiNDR provides an integrated response with the Fortinet Security Fabric and third-party vendors.

Features and Benefits

FASTER INCIDENT DETECTION

ML, deep learning, and other advanced analytics assess the “big data” of network activity

EFFICIENT INVESTIGATIONS

Automated threat hunting, streamlined workflows, playbooks accelerate in-house team triage

ACCELERATED THREAT RESPONSE

Dynamic threat-intelligence sharing enables automated and coordinated action

PROVEN AI

10+ years experience applying AI to threat data yields supervised & unsupervised detection models

HISTORICAL NETWORK VISIBILITY

Up to 365-day retention of enriched network metadata facilitates thorough investigations

OPEN PLATFORM APPROACH

Integration with the Fabric and APIs for third-parties ensure fit within security infrastructure

FortiNDR Use Cases

FortiNDR detects threats that may slip past traditional security solutions by using ML and AI, combined with FortiGuard intelligence, updates, and expertise.

NETWORK ANOMALY DETECTION

Monitor and profile traffic using ML models and other analytics from FortiGuard to identify potential intrusions.

THREAT HUNTING

Proactively search network metadata for signs and scope of cyber intrusion.

ZERO-DAY MALWARE PROTECTION

Analyze unknown code, inline or out-of-band, to classify against 20+ attack classes using more than 6 billion file attributes.

Features	FortiNDR (HW/VM)	FortiNDR Cloud
Deployment	On-prem	SaaS
Security Analyst	Virtual Security Analyst™	Guided-SaaS with TSM (Technical Success Manager)
Data Storage Location	On-prem	Cloud-based (US)
Data Retention	Throughput/Disk-dependent	365 days
Investigation/Threat Hunting	Outbreak search	Guided playbooks and parallel hunting
NetFlow/IPFIX support	Yes	--
High Throughput Malware Scan / NFS Scanning	Yes ANN¹ with On-prem learning	Hash lookup
MITRE ATT&CK Framework Mapping	Malware mapped to MITRE ATT&CK Framework	Detections mapped to MITRE ATT&CK framework
Response Integration	Fortinet Security Fabric Third-party API (Rest) MetaStream with Signals
Sensors	Hardware - FortiNDR-3500F VM16 / VM32 (ESXi / KVM) AWS / Azure / GCP / Alibaba	Hardware - FortiNDRCloud-900F (Large sensor) Hardware - FortiNDRCloud-500F (Small sensor) Virtual sensors (AWS / Azure / ESXi / KVM)
FortiGuard Labs Threat Research	✓	✓

1. Artificial Neural Networks

FortiNDR represents the future of AI-driven breach protection technology, designed for short-staffed Security Operation Center (SOC) teams to defend against various threats including advanced persistent threats through a trained Virtual Security Analyst™ that helps you identify, classify, and respond to threats including those well camouflaged. FortiNDR employs patent pending* Deep Neural Networks based on Advanced AI and Artificial Neural Network to provide sub-second investigation by harnessing deep learning technologies that assist you in an automated response to remediate different breeds of attacks.

First Name

Last Name

Company

Email Address

Phone

Country/Region

Zip/Postal Code

I consent to receive promotional communications (which may include phone, email, and social) from Fortinet. I understand I may proactively opt out of communications with Fortinet at anytime.

By clicking submit you agree to the Fortinet Terms and Conditions & Privacy Policy.

address1

Security Operations

To keep up with the volume, sophistication, and speed of today’s cyber threats, you need AI-driven security operations that can function at machine speed. Fortinet Security Operations enables advanced threat detection, response capabilities, centralized security monitoring, and optimization to easily be added across the entire Fortinet Security Fabric.