Fortinet FortiInsight
Enhanced Insider Threat Protection
Sorry, this product is no longer available. Please Contact Us for a replacement.
Overview
FortiInsight is a unique data security and threat detection solution that delivers advanced threat hunting to help you spot, respond to and manage risky behaviors that put your business-critical data at risk. We combine powerful and flexible Machine Learning with detailed forensics around user actions to bring focus to the facts more rapidly than other solutions.
Augmented Intelligence (AI)
Enhanced data visibility with machine learning and User and Entity Behavior Analysis (UEBA). Machine learning optimizes each stage of the investigation pipeline, identifying emerging threats, from compromised accounts to data theft.
Regulatory Compliance Support
Get full visibility of how data is accessed, used, and moved within your organization, and create compliance framework-specific rules, reporting, and analysis to identify, respond to, and manage non-compliant behavior.
Monitoring and Forensic-level Reporting
Monitor data movement and endpoint activity 24/7 regardless of location or whether users are on or off your network. Compile a full forensic history of user behavior, enabling thorough investigation and detailed reporting.
Highlights
- Endpoint agents result in a very low touch on system resources, with only endpoint meta-data collected.
- Instant insights around your data activities as agents collect data from the moment they are installed.
- Real-time data processing and analysis of user behavior results in rapid incident response capabilities.
- Learns what normal activity is at user, system and network layers to provide complete coverage of your environment and deep forensic capability.
- FortiInsight integrates with FortiSIEM, or your SIEM of choice, via an API that allows you to consume Policy and AI alerts, giving you the capability for the first time to correlate from the perimeter to the centre of your network.
Key Features and Operating Information
Our award-winning technology provides complete visibility of activities around your data — the who, what, where and when — by monitoring user behavior and data movement both on and off the network, and instantly alerting to anomalous activities. Security posture is strengthened, sensitive information is protected, and regulatory compliance is supported.
- FortiInsight is a hosted solution.
- Endpoint Agent technology provides visibility on files being moved to or from cloud storage applications, Skype, InstantMessenger, etc. complete with tracking of file names being moved via encrypted means.
- UEBA, powered by rule sets and augmented with AI, detects known and unknown threats ranging from malicious insider activity to compromised accounts.
- Recording of user, machine, application, file, behavior and network destinations/source activities results in a complete forensic level of detail for investigation and compliance purposes.
- The big data storage architecture of endpoint meta-data allows for retroactive rules and the ability to “go-back-in-time” to see past events in the current context.
- The Endpoint Agent “store-and-forward” capability reports on potentially suspicious activity when offline eliminating network blind spots.
- Using the latest big data technology, FortiInsight collects billions of events which are collated, analyzed, and presented to your security team giving you near instant access to the information collected. For example, who downloaded the payroll database? Why is someone uploading a customer list to that IP address? How many people are using unapproved cloud storage apps?
- Endpoint agents are available for Windows.
How FortiInsight Works
The zero-config, lightweight agent installed on each system performs no analysis or preventative actions on the endpoint. Rather, the agent simply gathers and sends data for alerting or investigation. This ‘endpoint agent’ approach has significant advantages as it presents a smaller attack surface to sophisticated attackers, reduces performance drain on the endpoint, and sends telemetry to a cloud-based service that stores, analyzes and presents data to the security team. By centralizing the data, FortiInsight is able to correlate and machine learn across your entire estate, providing you with unparalleled insights into user and data behavior.
With FortiInsight, the sophisticated rules-based engine bolstered by smart machine learning ensures all activities are monitored on and off the network. Rules are drawn up to agree what constitutes acceptable user activity. The rules are applied and if activity takes place that breaches these rules, an alert is sent to the administrator. This feature-set is also harnessed extensively to deliver insight into potential breaches around compliance regimes (such as GDPR and HIPAA).
The FortiInsight solution utilizes machine learning which examines behavior around data — and data flow — to spot anomalies such as users who are acting out of character, for example, looking at files they don’t normally seek out, or unusual changes in work patterns, compromised accounts or changes in peer group activities.
Documentation:
Download the Fortinet FortiInsight DataSheet (PDF).