Key Features and Operating Information
Our award-winning technology provides complete visibility of activities around your data — the who, what, where and when — by monitoring user behavior and data movement both on and off the network, and instantly alerting to anomalous activities. Security posture is strengthened, sensitive information is protected, and regulatory compliance is supported.
- FortiInsight is a hosted solution.
- Endpoint Agent technology provides visibility on files being moved to or from cloud storage applications, Skype, InstantMessenger, etc. complete with tracking of file names being moved via encrypted means.
- UEBA, powered by rule sets and augmented with AI, detects known and unknown threats ranging from malicious insider activity to compromised accounts.
- Recording of user, machine, application, file, behavior and network destinations/source activities results in a complete forensic level of detail for investigation and compliance purposes.
- The big data storage architecture of endpoint meta-data allows for retroactive rules and the ability to “go-back-in-time” to see past events in the current context.
- The Endpoint Agent “store-and-forward” capability reports on potentially suspicious activity when offline eliminating network blind spots.
- Using the latest big data technology, FortiInsight collects billions of events which are collated, analyzed, and presented to your security team giving you near instant access to the information collected. For example, who downloaded the payroll database? Why is someone uploading a customer list to that IP address? How many people are using unapproved cloud storage apps?
- Endpoint agents are available for Windows.
How FortiInsight Works
The zero-config, lightweight agent installed on each system performs no analysis or preventative actions on the endpoint. Rather, the agent simply gathers and sends data for alerting or investigation. This ‘endpoint agent’ approach has significant advantages as it presents a smaller attack surface to sophisticated attackers, reduces performance drain on the endpoint, and sends telemetry to a cloud-based service that stores, analyzes and presents data to the security team. By centralizing the data, FortiInsight is able to correlate and machine learn across your entire estate, providing you with unparalleled insights into user and data behavior.
With FortiInsight, the sophisticated rules-based engine bolstered by smart machine learning ensures all activities are monitored on and off the network. Rules are drawn up to agree what constitutes acceptable user activity. The rules are applied and if activity takes place that breaches these rules, an alert is sent to the administrator. This feature-set is also harnessed extensively to deliver insight into potential breaches around compliance regimes (such as GDPR and HIPAA).
The FortiInsight solution utilizes machine learning which examines behavior around data — and data flow — to spot anomalies such as users who are acting out of character, for example, looking at files they don’t normally seek out, or unusual changes in work patterns, compromised accounts or changes in peer group activities.