Fortinet FortiWeb 3000F Threat Analytics Service, 1-Year (FC-10-FW3KF-579-02-12)

Individual blocked requests tell a security team what was stopped, but not who is running the campaign or how persistent the threat actor is. FC-10-FW3KF-579-02-12 changes that for the FortiWeb 3000F by adding a full year of Threat Analytics Service: the subscription aggregates and cross-correlates web application events over time, assigns threat scores to source IPs and sessions, and identifies coordinated attacker behavior that a per-request enforcement model cannot see. The result is a ranked view of active threats rather than a flat log of individual blocked events.

Overview

Threat Analytics Service extends the FortiWeb 3000F’s detection model from per-request enforcement to session-level and campaign-level analysis. The service correlates events across the 3000F’s traffic stream, building behavioral profiles of sources that make repeated probing requests, rotate user agents, or exhibit patterns consistent with reconnaissance or credential attacks. Threat scores assigned to individual IPs and sessions give security teams actionable prioritization: high-scoring sources can be blocked proactively, before a full attack sequence completes, because the correlation identifies the pattern earlier than signature matching alone. The service is a native FortiWeb capability activated by the subscription and integrated directly into the appliance’s policy and logging framework, with no external analytics platform required.

Who it suits

Organizations running the FortiWeb 3000F to protect high-value applications, public-facing APIs, or login surfaces under persistent automated probing campaigns will benefit most from Threat Analytics Service. Security operations teams that need to prioritize response effort across large volumes of daily WAF events will find the threat-score output a practical triage tool. The service is particularly useful in environments where attackers rotate through multiple IPs or user agents to avoid rate-based controls, since cross-session correlation identifies the campaign even when no single source exceeds a fixed threshold. Mature SOC teams that forward FortiWeb events to a SIEM can use the threat scores as a pre-processed signal to reduce analyst review time.

Buying from DataCenter360.ca

FC-10-FW3KF-579-02-12 is an electronic subscription with no hardware component, available to FortiWeb 3000F operators anywhere in the world. DataCenter360.ca is an authorized Fortinet Select Partner that handles fulfillment through official Fortinet licensing channels. Purchasing this subscription generates a registration key you apply to your FortiWeb 3000F serial number through the Fortinet Support portal, activating Threat Analytics for the full 12-month term. The subscription works alongside other FortiWeb add-ons; teams evaluating it in combination with the FortiWeb Security Service or FortiCloud Sandbox can request a combined quote from DataCenter360.ca before placing an order to review all options at once.

Frequently asked questions