FortiAnalyzer centralizes Fortinet logs, turns them into alerts, incidents and reports. Key design choices, retention, automation and what changed in 8.0.
FortiAnalyzer is Fortinet's log management and security analytics platform: it collects logs from FortiGate firewalls and other Security Fabric devices, correlates them, raises alerts and incidents, and produces scheduled reports. For network and security teams, it is the place where firewall events become evidence that can be searched, investigated and presented to management or auditors. The current major branch in 2026 is FortiAnalyzer 8.0, released in April 2026, while 7.6 remains widely deployed.
A FortiGate generates traffic, UTM, event and system logs continuously. Kept on the device, these logs are limited by local storage and are hard to correlate across sites. FortiAnalyzer centralizes them and adds three layers of value:
Beyond FortiGate, FortiAnalyzer accepts logs from other Fortinet products such as FortiMail, FortiWeb, FortiClient EMS and FortiSandbox. The Fabric integration lets a FortiGate display FortiAnalyzer data in its own interface and trigger automation stitches from FortiAnalyzer events.
Most FortiAnalyzer problems come from sizing and retention choices made too quickly. Before deployment, answer a few questions:
Log transport from FortiGate should be reliable and encrypted, and the FortiAnalyzer management interfaces should be reachable only from administration networks. Fortinet has hardened the platform over recent releases: shell access was removed in 7.6.0, the legacy XML API was removed in 7.6.5 and 8.0.0, configuration backups must now be password protected, and new installations enforce a stronger default password policy. Review the release notes of your target version before any upgrade.
Collecting logs is only useful if someone acts on them. FortiAnalyzer evaluates incoming logs against handlers, called event handlers in earlier releases and alert handlers in the 8.0 documentation. Predefined handlers cover common situations such as malware detections, compromised hosts or repeated authentication failures, and administrators can write their own conditions.
When a handler fires, it can notify by email, syslog or other channels, and analysts can group related alerts into an incident with a status, an owner and a timeline. Playbooks automate repetitive steps, for example enriching an alert, collecting related logs, or asking a FortiGate to quarantine a host. Automation should be introduced gradually: start with enrichment and notification, then move to containment actions once the team trusts the detection logic.
FortiAnalyzer 8.0.1 extends this area with AI-assisted triage and investigation features, enrichment with MITRE ATT&CK context and threat intelligence, and native support for collecting telemetry through a FortiSIEM collector. These capabilities help analysts, but they do not replace well-tuned handlers and a documented triage process.
Reports are often the first reason organizations buy FortiAnalyzer. The platform ships with predefined report templates, for example on bandwidth and applications, web usage, threats and VPN activity, built from charts and datasets that rely on SQL queries against the log database. Reports can be scheduled, filtered by device or ADOM, and delivered automatically.
Good reporting practice means designing each report for its audience:
Custom datasets allow precise questions, but they should be tested on realistic data volumes: a badly written query can slow report generation on a busy unit.
A FortiAnalyzer that nobody watches quickly becomes an expensive archive. A minimum routine includes checking that every expected device is still sending logs, monitoring disk usage against the data policy, reviewing and tuning noisy handlers, and testing the restoration of a configuration backup. Log forwarding to a third-party SIEM is possible when the organization already runs a central SIEM, and in that case responsibilities between the two platforms should be written down clearly.
Administering FortiAnalyzer requires good knowledge of FortiOS logging, ADOMs, storage policies and high availability, while using it for detection and investigation calls for SOC analysis skills. Securevalley Training offers certification preparation courses for both roles: FortiAnalyzer 7.6 Administrator for deployment and administration, and FortiAnalyzer 7.6 Analyst for alert handling, incidents and reporting. Teams that want vendor-neutral SOC methods can add the Certified SOC Analyst (C|SA) course, delivered as an EC-Council Authorized Reseller.
FortiAnalyzer gives a Fortinet environment a central memory and an analysis layer. Its value depends less on the number of features than on sound retention design, tuned alert handlers and reports written for real readers. Teams that invest in these foundations will get far more from the platform, whatever version they run.