Fortinet FortiWeb VM04 Threat Analytics Service, 1-Year (FC-10-VVM04-579-02-12)

Running a 4 vCPU FortiWeb virtual appliance at mid-range traffic volumes generates more security events per day than a lighter deployment. Without correlation, a coordinated scanning campaign or slow-rate exploitation attempt surfaces as hundreds of individually low-severity alerts. Threat Analytics Service applies ML-based event correlation to the VM04’s event stream, grouping related incidents and assigning risk scores so that the most significant attack sequences become visible without requiring analysts to review each alert individually.

Overview

Threat Analytics Service (svc 579) adds a machine-learning event correlation layer to the FortiWeb VM04. The service aggregates WAF events across sessions and time windows, identifies behavioral patterns such as repeated probing of the same endpoint, rotating source IPs targeting the same application, or escalating request anomalies, and assigns risk scores to correlated incident sets. Higher scores indicate coordinated attack activity rather than isolated probes. At the event volumes a VM04 deployment produces, the service filters that volume into a prioritized list of incidents warranting analyst attention. Detection models are maintained by Fortinet and updated continuously through the subscription.

Who it suits

Security teams with limited analyst capacity running a VM04 benefit most from Threat Analytics. The correlation output reduces the daily volume of events requiring individual review, focusing analyst time on scored incident sets that indicate genuine attack campaigns. Teams protecting multiple web applications behind a single VM04 instance gain an additional benefit: cross-application event correlation can reveal campaigns targeting different applications from the same source infrastructure, a pattern that per-application event views cannot expose.

Buying from DataCenter360.ca

DataCenter360.ca is an authorized Fortinet Select Partner. Threat Analytics Service registered to a VM04 serial number activates immediately upon electronic delivery. For mid-range deployments where the VM04’s 4 vCPU throughput generates event volumes that make alert-by-alert review impractical, ML correlation provides a proportionately higher operational return than it does on lighter virtual appliances. Contact DataCenter360.ca for multi-year Threat Analytics pricing or to evaluate the full set of VM04 add-on subscriptions for your environment.

Frequently asked questions