Definition
FortiAnalyzer centralizes Fortinet device logs, analysis and reporting to support security investigations.
How it works
FortiGate units forward traffic, event and security logs according to configured policies. ADOMs, indexes, retention and permissions organize operations; capabilities vary by version and licensing.
Real-world example
Following an IPS alert, an analyst searches related connections, correlates events and builds an incident report.
Limits and best practices
Size log storage and retention, synchronize clocks and secure transport and access. Missing events may reflect insufficient logging configuration.