Licensing

• Overview
• Prerequisites

• License for New Users
  • Registering Base FortiSIEM Product
  • Adding Additional Devices/Services
• License for Existing Users

Overview

Starting release 4.10.0, FortiSIEM will only accept licenses issued by FortiCare. AccelOps license server will not issue any more licenses effective immediately.

FortiSIEM license key generation has been improved. Starting September 11, 2017, FortiCare will generate licenses ONLY using the new license key generation algorithm and will only work with FortiSIEM 4.10.0 and later releases. This has the following implications: If you want a new FortiCare license key, for any reason (for example, to extend maintenance and support or buy additional device license), you must upgrade to 4.10.0 first and then apply the 4.10 license. If you are upgrading to FortiSIEM 4.10.0, you must get a newly generated license key before starting the upgrade process.

Note: FortiSIEM license issued by AccelOps license server will continue to work until the license expires. However, you have to get a new license from FortiCare if:

• your current FortiSIEM license has expired.
• you must buy additional services.
• you have a valid license and must upgrade to FortiSIEM 4.10.0 and above.

Prerequisites

Before proceeding with FortiSIEM license registration, read and save the required information related to the following:

1. Registration Code
2. Hardware ID
3. FortiSIEM Image Download Site

1) Registration Code

FortiSIEM product functionality is driven by the product SKUs below. You have to first purchase the right combination of SKUs based on your needs from Fortinet. You will receive the registration letters via email that will contain a separate registration code for every SKU. You must use these registration SKUs to obtain FortiSIEM license.


Product	SKU	Description
FortiSIEM Base Product
FortiSIEM All-In-One Perpetual License	FSM-AIO-BASE	Base All-In-One (AIO) Perpetual License for 50 devices and 500 EPS.
	FSM-AIO-XXXX-UG	Add X devices and EPS/device All-In-One (AIO) Perpetual license for Non-MSP/MSP's.
FortiSIEM All-In-One Subscription License	FC[1-8]-10-FSM98-180-02-DD	Per Device Subscription License that manages minimum X devices, 10 EPS/Device.
FortiSIEM Raw Event Size Based Licensing	FC[1-8]-10-SMGS1-1026-02-DD	Requires FortiSIEM 7.2.2 or later. Only available for on-premises VM based deployments. License is based on: Total Raw event size per day (GB/Day) Number of Agents Number of UEBA Agents FortiGuard IOC The user is allowed to have 11 violations in a rolling 30-day window. After that, the Analytics and Dashboard pages are disabled for 1 day. In this license scheme, users can have as many devices and events per second (EPS) as can be supported by their deployed hardware, without violating the Total Raw event size per day (GB/Day) limits.
FortiSIEM Additional Products
FortiSIEM End-Point Device Perpetual License	FSM-EPD-XX-UG	Add XX End-Points and 2 EPS/ End-Point for End-Point Perpetual License
FortiSIEM End-Point Device Subscription License	FC[1-8]-10-FSM98-184-02-DD	Per End-Point Subscription License for minimum X End-Points, 2 EPS/End-Point
Add 1 EPS Perpetual License	FSM-EPS-100-UG	Add 1 EPS Perpetual
Add 1 EPS Subscription License	FC1-10-FSM98-183-02-DD	Add 1 EPS Subscription
FortiSIEM Advanced Agent License	FSM-AGT-ADV-XX-UG	XX Advanced Agents - Log & FIM - perpetual license. Each Agent requires a device license. Does not include Maintenance & Support.
FortiSIEM Advanced Agent Subscription License	FC[1-8]-10-FSM98-182-02-DD	Per Agent Subscription License - Log & FIM - minimum XX Advanced Agents. Does not include Maintenance & Support.
IOC Service Subscription License	FC[1-G]-10-FSM98-149-02-DD	(X Points) FortiSIEM Indicators of Compromise (IOC) Service. 1 device or 2 End points or 3 Windows Agents equals 1 point.
FortiSIEM High Availability Subscription	FCX-10-FSM98-593-02-DD	(XX - YY Points) FortiSIEM High Availability Cluster Subscription
FortiSIEM Support
FortiCare Support for FortiSIEM	FC[1-G]-10-FSM97-248-02-DD	24x7 FortiCare Contract (X points). 1 device or 2 End points or 3 Windows Agents equals 1 point.

2) Hardware ID

The Hardware ID (UUID) is used to uniquely identify the server where FortiSIEM Supervisor node will run. Based on the user-level, follow the steps below to get the Hardware ID.

• New user:

  Follow one of the methods below:

  • Open https://<ip_of_supervisor>/.
    The license upload page displays the Hardware ID.
  • Go to the server where FortiSIEM Supervisor node has to be installed or is currently installed.
    1. Login via SSH as root.
    2. Run the command cat /sys/class/dmi/id/product_uuid
    3. Note the output – you will need this to create a license.
       

• Existing user:
  • Flash GUI: Go to Admin > License Management.
  • HTML5 GUI: Go to ADMIN > License > License.

3) FortiSIEM Image Download Site

• Fresh installation:
  • If you are new to Fortinet products and do not have a support account other than FortiSIEM, download the FortiSIEM image from the Fortinet Support website https://support.fortinet.com. See "Downloading FortiSIEM Products" for more information on downloading products from the support website.
  • If you have existing Fortinet products, login to the Fortinet support site and find the image under Download > Firmware Images.

License for New Users

This section describes the procedures for new FortiSIEM users to license FortiSIEM product. There is no Base requirement for Subscription License, but the Ordering Quantity has to meet minimum quantity requirements of each SKU.

Note: The base device related SKUs has to be registered first.

Base SKU	Description
FSM-AIO-BASE	Base all-in-one Perpetual License for 50 devices and 500 EPS
FC[1-8]-10-FSM98-180-02-DD	Per Device Subscription License that manages minimum X devices, 10 EPS/Device.
FC[1-8]-10-SMGS1-1026-02-DD	Requires FortiSIEM 7.2.2 or later. Only available for on-premises VM based deployments. License is based on: Total Raw event size per day (GB/Day) Number of Agents Number of UEBA Agents FortiGuard IOC The user is allowed to have 11 violations in a rolling 30-day window. After that, the Analytics and Dashboard pages are disabled for 1 day. In this license scheme, users can have as many devices and events per second (EPS) as can be supported by their deployed hardware, without violating the Total Raw event size per day (GB/Day) limits.

Other FortiSIEM products such as additional devices, windows agents, IOC Services, Maintenance and Support etc. can be added after the Base has been registered.

• Registering Base FortiSIEM Product
• Adding Additional Devices/Services

Registering Base FortiSIEM Product

1. Go to FortiCare Product Registration link: https://support.fortinet.com/
2. Click Register to create an account.
3. Log in using your Account ID/Email and Password.
4. Click the Register More button.
5. On the Register Product > (1) Register Code page, in the Registration Code field, enter the Registration Code of the Base license based on the license type.
   
   • Subscription based license: Open the SKU file corresponding to the Subscription based license:
     FC[1-8]-10-FSM98-180-02-DD and get the Registration code.
   • Perpetual license: Open the SKU file corresponding to the Base Perpetual License:
     FSM-AIO-BASE and get the Registration code.
     
   
   
6. Select the End User Type and click Next.
7. On the Register Product > (2) Registration Info page, select the Fortinet Partner type from the list. The Hardware ID (also referred to as UUID), and Product Description fields are optional.
   
   
8. Click Next.
9. Read and agree to the terms and conditions of Fortinet Product Registration Agreement and click Next.
10. On the Verification page, read and agree to the terms, and click Confirm.

    

11. Verify the information displayed under Product Info.
    Note the Serial Number. You will need it in the following steps. Click Done.
12. Go to Products > Product List and click the Serial Number obtained from the previous step.
    
    
13. Click on the pencil icon to edit. The Edit Product Information window appears. Associate the Hardware ID of the VM where the Supervisor is going to run . The Hardware ID can be obtained by following the steps in Prerequisites (b).
14. Enter the Hardware ID in the Edit Product Information page and click Save.
    
    
15. Select License & Key and click Get The License File link to download the license.
    Note: If you must add additional devices to the license, download the license file after adding all the devices following the steps under "Adding Additional Devices/Services".
    
    
    
16. Download and install FortiSIEM. See Prerequisites (c) for the image location.
17. Once FortiSIEM is installed, log in and click Browse to select the license file.

    Note: If the UI does not redirect to the license upload screen, open https://<ip_of_supervisor>/phoenix/licenseUpload.html and upload the license file.

    

18. Enter the User ID (default value: admin) and Password (default value: admin*1).
19. Select the License Type based on the deployment type as:
    • Enterprise for single organizations
    • Service Provider for multiple organizations
    Note: For earlier versions of FortiSIEM, the License Type options displayed were VA for Enterprise and SP for Service Provider.
    
20. Click Upload which is enabled after selecting the license file.
21. Verify the license following one of the methods:
    1. Verify the license information on FortiSIEM GUI:
       • Flash GUI: Admin > License Management
       • HTML5 GUI: Admin > License> General.
         
    2. On the server where FortiSIEM is installed, execute the command on the license file and verify the license information:
       • # phLicenseRead <LicenseFile>
         
         

       [root@Autosuper### ~]# phLicenseRead FSMTEST########-####-####-####-#############.lic 
       License Information:
       Attribute                               Value                                   Expiration Date                         
       Serial Number                           FSM#############                        
       Hardware ID                             ########-####-####-####-############    
       Licensed Hardware ID                    ########-####-####-####-############    
       License Type                            Not Decided                             
       Devices                                 1000                                    Jun 19, 2025
       Endpoint Devices                        10                                      Jun 19, 2025
       Additional EPS                          1000                                    Jun 19, 2025
       Total EPS                               11020                                   Jun 19, 2025
       Agents                                  100                                     Jun 19, 2025
       UEBA Telemetry                          100                                     Jun 19, 2025
       IOC Service                             Valid                                   Jun 19, 2025
       High Availability Support               Valid                                   Jun 19, 2025
       Maintenance and Support                 Valid                                   Jun 19, 2025

       Note: Using this tool, you will not be able to identify the License type.

    3. On the server where FortiSIEM is installed, execute one of the following commands:
       • # phLicenseTool --show

       • # phLicenseTool --verify
         

         
         

         [root@Autosuper### ~]# phLicenseTool --show
         License Information:
         Attribute                               Value                                   Expiration Date                         
         Serial Number                           FSMS000000000000                        
         Hardware ID                             ########-####-####-####-############    
         Licensed Hardware ID                    ########-####-####-####-############    
         License Type                            Service Provider                        
         Devices                                 100000                                  Jun 17, 2025
         Endpoint Devices                        10                                      Jun 17, 2025
         Additional EPS                          N/A                                     N/A
         Total EPS                               1000020                                 Jun 17, 2025
         Agents                                  110                                     Jun 17, 2025
         UEBA Telemetry                          2                                       Jun 17, 2025
         IOC Service                             Valid                                   Jun 17, 2025
         High Availability Support               Valid                                   Jun 17, 2025
         Maintenance and Support                 Valid                                   Jun 17, 2025
         
         [root@Autosuper### ~]# phLicenseTool --verify
         license matched
         
         

Adding Additional Devices/Services

After registering the base license, you can register additional devices/services supported by FortiSIEM:

• Devices
• End points
• Windows Agents
• IOC Service
• Maintenance and Service

Follow the below steps to add a device/service:

1. Open the SKU related to get the Registration code. Refer to the table under Prerequisites (a).
2. On FortiCare, click Register Product and add the Registration code of the new device.
3. Click the Serial Number obtained while registering the base.
   
   
4. Click on the pencil icon to edit. The Edit Product Information window appears. Associate the Hardware ID and click Save.
   
   Note: If you are adding more devices or services, repeat the procedure of adding the related registration id to the same serial number and use the license generated at the end of registering all devices/services.
5. Select License & Key and click Get The License File to download the license.
6. Download and install FortiSIEM image from the Fortinet Support website https://support.fortinet.com. Refer to the Downloading FortiSIEM Products Guide for more information on downloading products from the support website.
7. Log in to FortiSIEM and click Browse to select the license file.
   
   Note: If the UI does not redirect to the license upload screen, openhttps://<ip_of_supervisor>/phoenix/licenseUpload.html and upload the license file.

   

8. Enter the User ID (default value: admin) and Password (default value: admin*1).
   
9. Select the License Type based on the deployment type of your organization as:
   • Enterprise for single organizations
   • Service Provider for multiple organizations
   
   Note: For earlier versions of FortiSIEM, the License Type options displayed were VA for Enterprise and SP for Service Provider.
10. Verify the license following one of the methods:
    1. On FortiSIEM GUI:
       • Flash GUI: Go to Admin > License Management
       • HTML5 GUI: Go to ADMIN > License > License.
    2. On the server where FortiSIEM is installed, execute the command on the license file and verify the license information:

       • # phLicenseRead <LicenseFile>
         

         [root@Autosuper### ~]# phLicenseRead FSMTEST########-####-####-####-#############.lic 
         License Information:
         Attribute                               Value                                   Expiration Date                         
         Serial Number                           FSM#############                        
         Hardware ID                             ########-####-####-####-############    
         Licensed Hardware ID                    ########-####-####-####-############    
         License Type                            Not Decided                             
         Devices                                 1000                                    Jun 19, 2025
         Endpoint Devices                        10                                      Jun 19, 2025
         Additional EPS                          1000                                    Jun 19, 2025
         Total EPS                               11020                                   Jun 19, 2025
         Agents                                  100                                     Jun 19, 2025
         UEBA Telemetry                          100                                     Jun 19, 2025
         IOC Service                             Valid                                   Jun 19, 2025
         High Availability Support               Valid                                   Jun 19, 2025
         Maintenance and Support                 Valid                                   Jun 19, 2025

       Note: Using this tool, you will not be able to identify the License type.

    3. On the server where FortiSIEM is installed, execute one of the following commands:
       • # phLicenseTool --show

       • # phLicenseTool --verify

         [root@Autosuper### ~]# phLicenseTool --show
         License Information:
         Attribute                               Value                                   Expiration Date                         
         Serial Number                           FSMS000000000000                        
         Hardware ID                             ########-####-####-####-############    
         Licensed Hardware ID                    ########-####-####-####-############    
         License Type                            Service Provider                        
         Devices                                 100000                                  Jun 17, 2025
         Endpoint Devices                        10                                      Jun 17, 2025
         Additional EPS                          N/A                                     N/A
         Total EPS                               1000020                                 Jun 17, 2025
         Agents                                  110                                     Jun 17, 2025
         UEBA Telemetry                          2                                       Jun 17, 2025
         IOC Service                             Valid                                   Jun 17, 2025
         High Availability Support               Valid                                   Jun 17, 2025
         Maintenance and Support                 Valid                                   Jun 17, 2025
         
         [root@Autosuper### ~]# phLicenseTool --verify
         license matched
         
         
         

License for Existing Users

For existing FortiSIEM customers, licenses are already imported into FortiCare. While the current FortiSIEM license will continue to work until the license expires, you have to get a new license from FortiCare, if you want to renew the license or buy additional products. Follow the below procedure to get a license:

1. Go to FortiCare Product Registration link: https://support.fortinet.com/.
2. Log in using your Account ID/Email and Password.
3. Click Products > My Assets.
   The Serial Number corresponding to your license will be displayed.
   
   
4. Click the Serial number to get the production information.
   
5. Click on the pencil icon to edit. The Edit Product Information window appears. Associate the Hardware ID and click Save. Refer to Prerequisites (b) section to get the Hardware ID.
   
   
6. Select License & Key and click Get The License File to download the license.
   
   
   
7. Before installing the license, please verify that you have the right license installed. The system will not function if you have an incorrect license.
   Verify the license:
   1. Download the phLicenseRead tool from the image download site. See Prerequisites (c).
   2. Copy the phLicenseRead tool to /opt/phoenix/bin in the Supervisor node. Make sure the permissions are correct (root/root).
   3. Execute the command on the license file downloaded in Step 6 to verify the license information: # phLicenseRead <LicenseFile>

   Note: Using the phLicenseRead tool, you will not be able to identify the License type.
   

   
   Note: If the license is incorrect, contact Fortinet support to get the right license. Do not install partial license.
   
8. Upgrade FortiSIEM.
   Refer to the Upgrade Guide under FortiSIEM Reference Manuals for information about the upgrade process.
9. After the Supervisor reboots, log in to the Supervisor node and click Browse to upload the license file from Step 6.
   
10. Enter the User ID (default value: admin) and Password (default value: admin*1).
11. Click Upload.
12. Verify the license information from the GUI.
    • Flash GUI: Admin > License Management
      
      

      

    • HTML5 GUI: ADMIN > License > License/Usage/Nodes