FortiInsight, UEBA and FortiSIEM | Securevalley

July 2, 2026 · Nouh Droussi · Fortinet · Maroc · 4 min read · Updated September 26, 2026

The former FortiInsight UEBA product has had its analytics engine integrated into FortiSIEM. What to know about user and entity behavior analytics.

FortiInsight was Fortinet's standalone user and entity behavior analytics (UEBA) solution. It no longer appears in Fortinet's product catalog today: its analytics engine was integrated into FortiSIEM starting with version 6.1, in 2020, and this technology is now offered in the form of the UEBA feature within FortiSIEM. If you are still using FortiInsight, FortiSIEM is therefore the place you should be looking.

The status of FortiInsight in 2026

When FortiSIEM 6.1 was released, Fortinet announced that the SIEM now embedded the same UEBA analytics engine as FortiInsight. Since then, the FortiInsight product page has been taken offline, and the current FortiSIEM documentation (7.x branch) describes UEBA as a feature of the SIEM, with its own licensing. Traces of this heritage can still be found in FortiSIEM, where the UEBA analytics service still carries the technical name phFortiInsightAI.

For organizations that still hold FortiInsight licenses, the exact end-of-support dates are listed on the Product Life Cycle portal of Fortinet support. It is wise to check them now and to start planning the migration, either to FortiSIEM or to another analytics platform.

What UEBA is

UEBA consists of establishing, for each user and each entity (workstation, server, application), a profile of usual behavior, and then flagging significant deviations from it. Rather than looking for a known attack signature, the analysis focuses on questions such as:

• is this user logging in at an unusual time or from an unusual location?
• is this workstation suddenly accessing an abnormal volume of files?
• is this account using tools it never uses?
• does this behavior differ markedly from that of colleagues in the same department?

This approach is particularly useful against insider threats, compromised accounts and data exfiltration, three situations in which the attacker uses legitimate access and therefore escapes traditional controls.

How FortiSIEM collects UEBA data

The FortiSIEM documentation describes two main sources:

• FortiSIEM agents with the UEBA option enabled, which are recommended for the best visibility. They collect user activity without requiring any specific Windows audit configuration, and they continue to record telemetry when the workstation is outside the corporate network, then transmit it once it reconnects;
• agentless telemetry from FortiGate devices, which is useful when deploying agents is not possible, but which is more limited.

The data is organized along five dimensions used by the machine learning models: the user, the process, the device, the resources accessed and the action performed. The SIEM then combines this information with the data from its other sources (logs, network flows, cloud APIs) to generate incidents.

Limitations and points of attention

Behavioral analytics is not magic. It requires:

• a learning period long enough to build reliable profiles;
• gradual tuning to reduce false positives, which are frequent at the start;
• a clear legal framework: monitoring employee activity involves personal data. In Morocco, law 09-08 on the protection of individuals with regard to the processing of personal data applies, and transparency toward employees must be organized together with the legal and HR functions;
• analysts capable of interpreting a risk score and comparing it with the business context.

Alternatives and ecosystem

UEBA is now a common feature of the SIEM and XDR platforms available on the market. If you are reassessing your tooling as FortiInsight reaches its end, compare in particular the quality of the available data sources, the integration with your identity management and the operational workload. The essentials remain the same from one platform to another: complete data, clearly defined use cases and a team to handle them.

Skills and training

UEBA is operated within a SOC. The key skills are event analysis, threat hunting and knowledge of SIEM tools. The following training paths prepare for this:

• Certified SOC Analyst (CSA) for the fundamentals of analyst work and event correlation;
• Splunk Cybersecurity Defense Analyst to practice security data analysis on a widely used SIEM;
• Microsoft SC-200 for security operations with Microsoft Sentinel and Defender, which also include behavioral analytics.

Conclusion

FortiInsight as a standalone product belongs to the past, but its technology lives on within FortiSIEM. For the teams concerned, the priority is to check the end-of-support dates, plan the transition and strengthen the analytical skills needed to make the most of UEBA.