Fortinet FortiWeb 600F Threat Analytics Service, 1-Year (FC-10-FV60F-579-02-12)

A busy FortiWeb 600F can generate thousands of individual attack log entries per hour. Manually triaging each event is slow and misses coordinated attack patterns that span multiple requests or sessions. This one-year Threat Analytics Service subscription applies machine learning correlation to the FortiWeb 600F event stream, grouping related events into scored incidents and surfacing the cases that represent genuine, prioritized risk.

Overview

The Threat Analytics Service collects attack log data from the FortiWeb 600F and runs it through a machine learning model that identifies relationships between events: repeated source IPs across multiple attack types, sequences suggesting reconnaissance before exploitation, and spike patterns characteristic of automated scanning. Each incident bundle receives a risk score based on attack severity, event frequency, source confidence, and behavioral context.

Analysts work from a ranked incident list rather than raw log volume, focusing investigation time on events most likely to represent real threats rather than scanner noise. The correlation engine runs in the cloud and requires no additional on-premises components beyond the subscribed FortiWeb appliance. Risk scores are updated dynamically as new events arrive, so an escalating source is re-ranked in near real time.

Who it suits

Security operations teams managing the FortiWeb 600F alongside other detection tools benefit most. When WAF logs feed into a larger incident queue, pre-scored and correlated events slot more naturally into triage workflows than unfiltered per-request alerts. Organizations with a small security team protecting multiple web applications find that ML correlation reduces the time spent separating automated scanner noise from targeted attacks.

Teams that already forward FortiWeb logs to a SIEM can treat Threat Analytics output as enriched, pre-triaged input rather than raw log lines, improving SIEM correlation accuracy without duplicating the FortiWeb-specific ML work.

Buying from DataCenter360.ca

DataCenter360.ca lists this as an electronic license available worldwide, renewed annually. Threat Analytics is one of the more specialized FortiWeb 600F add-ons; if you have questions about how it integrates with your existing SIEM or logging pipeline before committing, our team can assist. Contact us for volume pricing if you are deploying multiple FortiWeb units under the same subscription program.

Frequently asked questions