Fortinet FortiAnalyzer 1000G

The volume workhorse: higher sustained log rates and larger local storage for an estate that has outgrown the 800-class.

Logging, analytics and reporting for the Security Fabric

FortiAnalyzer is the logging, analytics and reporting half of Fortinet’s management story: FortiGate, FortiSwitch, FortiAP and FortiClient send their logs to it, and it turns them into correlated events, reports and the evidence trail an audit needs. It is also what several other Fortinet services depend on — the FortiClient forensics and SOCaaS subscriptions, for instance, state that a FortiAnalyzer is required and not included.

What the FortiAnalyzer 1000G is sized for

The FortiAnalyzer 1000G is licensed for the sustained log rate and GB/day shown in the specifications below. That figure, rather than the device count, is usually what decides the model: an estate sending more logs than the appliance is licensed to ingest will drop or throttle them regardless of how few devices are sending.

Analytics, AI and retention

Beyond collection, FortiAnalyzer correlates events across the fabric, runs scheduled and ad-hoc reports, and feeds incident workflows. A generative AI subscription adds large-language-model assistance to analysis and investigation, metered in tokens and topped up separately. Where local disk is not enough, a storage connector service can push older data to cloud storage so the retention window is not bounded by the chassis.