Fortinet FortiGate
Firewalls and network logs — Fortinet
What is this product?
A firewall that bundles protection, filtering and branch connectivity into one appliance. Its logs use short field names: `srcip`, `dstip`, `action`, `status`.
About the company
A US company founded in 2000; its FortiGate appliances are among the most widely deployed in the Middle East thanks to pricing that suits mid-sized companies.
What does an analyst do inside it?
- Reads `action: deny` to see what was blocked and why.
- Follows `srcip` across several log lines to build the full picture.
- Looks for signs of network scanning from a single address.
- Adds the address to the blocked address group.
Its search language
These examples are written in the syntax the product itself accepts.
- srcip: 10.20.4.19
- action: deny
The field names it uses
- srcip
- dstip
- action
- status
- devname
- user
- subtype
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
The most common option among mid-sized companies in Egypt, Saudi Arabia and the Gulf, making it a practical advantage in the local market.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.