FortiAnalyzer Federation roles

FortiAnalyzer Federation includes two operation modes, including supervisor and member.

• Supervisors acts as the root device in the FortiAnalyzer Federation. SOC administrators can use the supervisor to view member devices and their ADOMs and authorized logging devices, as well as incidents and events created on members.
• Members are devices in the FortiAnalyzer Federation that send information to the supervisor for centralized viewing. When configured as a member, FortiAnalyzer devices continue to have access to the FortiAnalyzer features identified in the FortiAnalyzer Administration Guide. Incidents and events are created or raised from each member.