What you are evaluating
This page covers FortiSIEM rather than the full Fortinet portfolio. Deployment models and behavior analytics or response features require edition checks. An IT/OT use case does not authorize active discovery or containment on operational equipment.
A useful evaluation context
Consider it when infrastructure visibility and SIEM investigations need shared context. Evaluate non-Fortinet sources and operational constraints directly instead of assuming portfolio integration guarantees coverage.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Collect supported security and infrastructure records for search and correlation.
- Use asset and configuration context to help identify affected systems and their operational significance.
- Connect detection and investigation workflows with available response integrations under defined permissions.
Where it fits in the work
- Start with approved lab sources and establish an independently known inventory of the systems involved.
- Validate event mappings and correlate a harmless sequence against the correct asset and owner.
- Review the proposed action with the responsible operations team and test the approval and audit path.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Model a supplier’s remote maintenance session into a fictional manufacturing support environment using exported lab logs.
Evidence to look for
Show the correlated activity, the affected asset and its owner. Explain why an IT alert alone is insufficient authority to isolate plant equipment, and demonstrate a recorded human approval step before any simulated response.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which deployment model and modules meet the intended collection and response requirements?
- How is discovered asset context reconciled with the authoritative inventory?
- What collection and discovery methods are approved for sensitive operational networks?
Names you may encounter: FortiSIEM. Historical names do not establish current availability or feature equivalence.