FortiAI data privacy

FortiAnalyzer and FortiAI protects your data using a multi-layered approach of function callbacks, data masking, and a secure proxy.

Function Callback: Your prompts are sent to the large language model (LLM), which generates a query that FortiAnalyzer can understand. This query is then executed on your local host, ensuring that results are processed locally.

Data Masking: Sensitive information such as IP addresses, MAC addresses, and usernames are automatically masked before being sent to the LLM, as the model does not need this data to form the query. When the function call returns to the local host, the data is unmasked.

For example:

• Prompt from Admin: "Give me the statistics of malware activities detected today from endpoint 192.168.50.20?"

• Masked data sent from FortiAnalyzer: "Give me the statistics of malware activities detected today from endpoint 12.198.37.2?"

In this example, 12.198.37.2 is an auto-generated, irrelevant IP address based on the session cookie.

Note that different values are masked using different methods within FortiAnalyzer; for instance, IP addresses are masked differently than usernames. The masked values also depend on the session cookie, ensuring that every session uses a different key to mask and protect data.

FortiAI Proxy: All FortiAI prompts pass through the Fortinet FortiAI proxy before reaching the cloud, where additional checks are performed to ensure your data is protected.

Example

1. The Admin enters a prompt in the FortiAnalyzer FortiAI Assistant.

   For example: "How much YouTube did 192.168.4.199 watch today?"

   The question is passed through the FortiAI proxy. Sensitive data, such as the IP, is automatically masked before it leaves FortiAnalyzer.

2. The LLM analyzes the question, determining the correct function to answer the prompt.

3. The LLM sends the function callback through the FortiAI proxy to FortiAnalyzer.

4. FortiAnalyzer unmasks the data and queries the database according to the function callback.

5. FortiAnalyzer replies to the Admin in the FortiAI Assistant.

   For example:

   "Here are today's statistics for IP 192.168.4.199 access to YouTube based on the logs:

   • Log Count: 1803

   • Percentage of Total: 99.83%

   • Total Sent Bytes: 10.5 MB

   • Average Session Duration: 00h 01m 52s

If there is further need to protect data from administrators, including the FortiAI users, you can also use the Privacy Masking feature in administrator profiles. This feature allows you to encrypt and anonymize data for administrators, further protecting user privacy according to your requirements. For more information, see Privacy Masking.