FCP FortiAnalyzer 7.4 case studies
FCP FortiAnalyzer 7.4 · Put your knowledge to work in context.
The FCP FortiAnalyzer 7.4 credential sits within the Fortinet Certified Professional track, the mid-tier of the Fortinet Training Institute Certification Program named on Fortinet's corporate site. It is aimed at security operations staff who deploy, run, and get analytical value out of FortiAnalyzer: SOC analysts, network security engineers, and administrators responsible for log retention, reporting, and investigation in Fortinet environments. The FCP FortiAnalyzer 7.4 case studies are 5 cases and about 2,664 words.
1HA Pair and ADOM Design for a Managed Security Provider
An MSSP operates 45 customer ADOMs on a pair of FortiAnalyzer 3000E appliances in HA. The primary receives about 450 GB of logs per day, with peaks near 900 GB during month-end scanning.
573 words, about 3 min2Third-Party Firewall Logs Missing from Reports
A utility company runs FortiAnalyzer 7.4 on a VM with a 500 GB/day license and 4 TB of virtual disk. It receives about 300 GB/day from 120 FortiGates and 150 Cisco ASA firewalls.
552 words, about 3 min3PCI Report Timeout and Undelivered Email
An online retailer must produce a monthly PCI DSS report from FortiAnalyzer 7.4. The schedule runs on the first day of each month at 02:00, covers the previous 90 days, and contains 14 custom datasets.
532 words, about 3 min4Event Handler Quarantine Causes NAT Outage
A hospital's FortiAnalyzer 7.4 event handler watches FortiGate VPN logs for failed login and, when 10 failures occur from the same source IP within 5 minutes, runs an automation stitch that quarantines the source IP on the FortiGate for 60 minutes. During an internal vulnerability scan, 280 quarantine actions were created in 20 minutes, including the hospital's NAT egress address, which blocked all remote users for an hour.
499 words, about 2 min5Late Investigation Using Archive Logs
A financial services firm uses FortiAnalyzer 7.4 with 14-day analytics retention and a 1-year archive of raw logs. On 3 March, the SOC receives a tip that a finance workstation at 10.20.8.44 may have been compromised on 10 February.
508 words, about 3 min