Fortinet black logo

FortiSIEM Reference Architecture Using ClickHouse

Home FortiSIEM 6.7.0 FortiSIEM Reference Architecture Using ClickHouse
6.7.0
7.1.5
7.1.4
7.1.3
7.1.2
7.1.1
7.1.0
7.0.3
7.0.2
7.0.1
7.0.0
6.7.9
6.7.8
6.7.7
6.7.6
6.7.5
6.7.4
6.7.3
6.7.2
6.7.1
6.7.0

Design for the Platform Use-Cases

Design for the Platform Use-Cases

FortiSIEM can be used for many applications across an enterprise, such as:

  • Log ingestion and storage

  • SOC Analytics and incident response

  • Performance monitoring

  • Compliance reporting

  • Management reporting

Many deployments will need several or all of these use-cases. Identifying and understanding the organizational use-cases and stakeholder requirements is a key step in designing a successful FortiSIEM solution, for example:

  • Log ingestion and storage requirements have a direct impact on the license, the number of nodes and event database sizing

  • SOC analytics and incident response requirements impact the requirements for integration with 3rd party systems, remediations, dashboards and other analyst features, as well as post-installation training

  • Performance monitoring impacts the number of nodes required to run performance jobs, plus dashboard design

  • Compliance reporting impacts the requirement for custom reporting, plus the selection of log sources to meet compliance monitoring needs

  • Management reporting requirements may need custom report building, and custom dashboards for management monitoring

Previous
Next

Design for the Platform Use-Cases

FortiSIEM can be used for many applications across an enterprise, such as:

  • Log ingestion and storage

  • SOC Analytics and incident response

  • Performance monitoring

  • Compliance reporting

  • Management reporting

Many deployments will need several or all of these use-cases. Identifying and understanding the organizational use-cases and stakeholder requirements is a key step in designing a successful FortiSIEM solution, for example:

  • Log ingestion and storage requirements have a direct impact on the license, the number of nodes and event database sizing

  • SOC analytics and incident response requirements impact the requirements for integration with 3rd party systems, remediations, dashboards and other analyst features, as well as post-installation training

  • Performance monitoring impacts the number of nodes required to run performance jobs, plus dashboard design

  • Compliance reporting impacts the requirement for custom reporting, plus the selection of log sources to meet compliance monitoring needs

  • Management reporting requirements may need custom report building, and custom dashboards for management monitoring

Previous
Next