How to Install FortiAnalyzer VM

Centralised Log Management

Aggregate logs from all FortiGate firewalls, FortiClient endpoints, FortiMail, FortiWeb, and FortiSwitch devices into a single searchable platform. Eliminates silo'd logs across multiple devices.

Incident Investigation

Search, correlate, and drill down into millions of log events during active incidents. Build timelines of attacker activity across your entire network from one interface.

Real-Time Alerting

Define event handlers that trigger alerts based on specific log patterns — failed authentications, policy violations, malware detections, or custom correlation rules.

Automated Reporting

Schedule and generate compliance reports (PCI-DSS, HIPAA, SOX) and custom security posture reports automatically. Eliminates manual reporting overhead.

Threat Hunting

Query historical log data with FortiAnalyzer's dataset engine to proactively hunt for indicators of compromise, lateral movement, and data exfiltration patterns.

Compliance & Forensics

Maintain tamper-evident log archives required for legal proceedings, regulatory audits, and forensic investigations. Logs are stored securely with integrity verification.

FortiAnalyzer VM is available in a stackable license model — you can start small and expand. Before deploying, plan your resource allocation based on how many devices will send logs and your expected daily log volume. Under-provisioning disk is the most common mistake.

FortiAnalyzer VM includes a free 15-day full-featured evaluation license that activates the first time you start the VM — no activation needed for trial. For production, you must register your license code with the Fortinet Support Portal to obtain the .lic license file required for full functionality.

◈ Registration Steps

• 1Navigate to support.fortinet.com and log in or create an account
• 2In the toolbar select Asset → Register / Renew — the Registration Wizard opens
• 3Enter the registration code from your FortiAnalyzer VM License Certificate email, then click Next
• 4Enter your support contract number, product description, Fortinet Partner, and the IPv4 management IP address of your VM
• 5Accept the Fortinet Product Registration Agreement, then click Confirm
• 6From the Registration Completed page, click License File Download — save the .lic file to your management computer

FortiAnalyzer VM deployment packages are bundled with firmware images on the Fortinet support site. The package you download depends on your hypervisor. Each package contains the correct VM image format (OVF/VMDK for VMware, VHD for Hyper-V, QCOW2 for KVM) plus the system and log disk images.

◈ Download Steps

• 1Log in to support.fortinet.com
• 2In the toolbar select Download → Firmware Images
• 3Select FortiAnalyzer from the product drop-down list, then click Download
• 4Browse to the appropriate firmware version directory (e.g. 7.6.x)
• 5Download the correct package for your hypervisor — see table below
• 6Also download the Release Notes from the same directory
• 7Extract the ZIP package to a folder on your management computer

VMware vSphere deployment uses the OVF (Open Virtualization Format) template wizard to import the FortiAnalyzer VM. Ensure VMware ESXi is installed and updated to the latest patch, and that vSphere Client is installed on your management computer before starting.

◈ Deploy OVF Steps

• 1Launch VMware vSphere Client, enter the ESXi host IP, username and password, then click Login
• 2From the top menu select File → Deploy OVF Template — the OVF Template Wizard opens
• 3Click Browse, locate the FortiAnalyzer-VM64.ovf file you extracted, then click Next
• 4The OVF Template Details page shows product name, download size and disk size — review and click Next
• 5Read the End User License Agreement, click Accept, then click Next
• 6Enter a name for the VM (up to 80 characters, must be unique in the inventory), click Next
• 7On the Disk Format page — select Thin Provision to allocate only used space. This allows a large log disk without consuming full SAN space immediately
• 8On the Network Mapping page — map Network 1 → port1 of FortiAnalyzer to your management virtual switch. This is required for console access
• 9Review the summary. Ensure "Power on after deployment" is NOT checked — you must configure hardware settings before first boot
• 10Click Finish — deployment begins. Wait for the "Deployment Completed Successfully" dialog

Before powering on, adjust the VM's virtual hardware to match your FortiAnalyzer license tier and environment requirements. This includes CPU, RAM, and the log disk (Hard Disk 2). Never modify Hard Disk 1 — this is the OS disk and must remain as-is.

◈ Hardware Configuration Steps

• 1In vSphere Client, right-click the FortiAnalyzer VM in the left pane and select Edit Settings — the Virtual Machine Properties window opens
• 2Select Memory from the Hardware list → adjust Memory Size to match your license tier (minimum 4 GB, recommended 8 GB+)
• 3Select CPUs from the Hardware list → configure Number of virtual sockets and Cores per socket (minimum 2 vCPU, recommended 4+)
• 4Select Hard Disk 2 (the log disk) from the Hardware list → expand the disk size to your required log storage capacity. Do NOT modify Hard Disk 1
• 5If you need additional network interfaces, click Add → select Ethernet Adapter → assign to the appropriate virtual switch
• 6Click OK to save all settings

With hardware settings configured, the VM is ready for first boot. Power on via any of the methods below. The first boot initialises the FortiAnalyzer OS and prepares the log disk — this may take several minutes.

◈ Power On Methods

• 1Select the FortiAnalyzer VM in the left pane, then click Power on the virtual machine in the Getting Started tab
• 2Or — select the VM then click Power On in the toolbar
• 3Or — right-click the VM and select Power → Power On
• 4Click the Console tab to open the VM console and watch the boot process
• 5Wait for the FortiAnalyzer login prompt to appear — press Enter if the screen is blank

Microsoft Hyper-V deployment uses the VHD disk files from the deployment package. The VM is created manually through the New Virtual Machine Wizard rather than an OVF import. Use VHDX format for the log disk — it supports up to 64TB and is resilient to power failure corruption.

◈ Hyper-V VM Creation Steps

• 1Launch Hyper-V Manager on your Microsoft server
• 2Right-click the server in the tree, select New → Virtual Machine — the New Virtual Machine Wizard opens
• 3Click Next for custom configuration, then enter a VM name on the Specify Name page
• 4On Assign Memory — set minimum 4096 MB (4 GB). Do not enable Dynamic Memory for FortiAnalyzer
• 5On Configure Networking — FortiAnalyzer requires up to 4 network adapters. Connect the first adapter to your management virtual switch
• 6On Connect Virtual Hard Disk — select Use an existing virtual hard disk and browse to the fmg.vhd file (the system disk)
• 7Click Finish to create the VM, then open Settings before powering on
• 8In Settings, configure Processor — set the number of virtual processors (minimum 2)
• 9Add remaining network adapters: Settings → Add Hardware → Network Adapter → repeat for each adapter needed. Select Virtio device model
• 10Add the log disk: Settings → IDE Controller 0 → Hard Drive → New → VHDX format → Dynamically Expanding → set size in GB
• 11Click Apply then OK, then power on the VM

KVM deployment uses the QCOW2 system image and the Virtual Machine Manager (virt-manager) GUI. All additional network interfaces must use the Virtio device model — using other models will cause network connectivity issues inside the FortiAnalyzer VM.

◈ KVM Deployment Steps

• 1Copy the fmg.qcow2 file to /var/lib/libvirt/images/ on the KVM host
• 2Launch Virtual Machine Manager (virt-manager) on the KVM host
• 3Click Create a new virtual machine from the toolbar
• 4Select Import existing disk image, then browse and select the fmg.qcow2 file
• 5Specify RAM and CPU allocation — minimum 4 GB RAM and 2 CPUs
• 6Expand Advanced options — select a network adapter on the host, optionally set a fixed MAC address
• 7Select Customize configuration before install, then click Finish
• 8In the hardware config window, click Add Hardware → Storage → Create a new disk image → set size to 80GB minimum (for log disk)
• 9Add additional NICs: Add Hardware → Network — set Device Model to Virtio for every adapter added
• 10Click Begin Installation to start the VM

Before you can access the GUI, you must configure a management IP address on port1 via the VM console CLI. This is done through your hypervisor's console window — no network access is required yet. The credentials at first boot are username: admin / password: (blank).

◈ CLI Setup Steps

• 1In your hypervisor manager, open the console window for the FortiAnalyzer VM
• 2Press Enter if the screen is blank to display the login prompt
• 3At the FortiAnalyzer login: prompt, type admin and press Enter
• 4At the Password: prompt, press Enter (blank password by default)
• 5You are now at the FortiAnalyzer CLI. Configure port1 IP address using the commands below
• 6After setting the IP, enable HTTPS access to allow GUI connections
• 7Verify the interface is configured correctly using the show command

There are two methods to upload the FortiAnalyzer VM license — via the GUI browser interface (recommended) or via CLI command. The GUI method is simpler and provides clear visual confirmation. After upload the VM reboots to validate the license against the Fortinet License Validation servers.

◈ Method 1 — GUI Upload (Recommended)

• 1From your management computer browser, navigate to https://192.168.1.100 (your port1 IP)
• 2Accept the self-signed certificate warning and log in with admin / blank password
• 3The license upload page appears — click Browse and locate your .lic file
• 4Click OK to upload — a reboot message appears
• 5The FortiAnalyzer VM reboots and validates the license with Fortinet servers
• 6Refresh your browser and log back in — the License Information widget will show Valid

◈ Method 2 — CLI Upload

After license validation, the full FortiAnalyzer GUI becomes available. The first login triggers the Setup Wizard which walks through essential configuration steps — time zone, admin password, network settings, and FortiCare registration. The Register with FortiCare step cannot be skipped and must be completed before full access is granted.

◈ GUI Setup Steps

• 1Open a browser on your management computer and navigate to https://<port1-IP-address>
• 2Log in with username admin and blank password (or your previously set password)
• 3The Setup Wizard launches automatically — click Begin
• 4Step — Change Admin Password: Set a strong password for the admin account. Document this securely.
• 5Step — System Time: Set the correct time zone and synchronise with an NTP server (critical for accurate log timestamps)
• 6Step — Network Settings: Confirm port1 IP, DNS servers, and default gateway are correct
• 7Step — Register with FortiCare: Enter your FortiCare credentials — this step is mandatory and cannot be skipped
• 8Click Finish — the FortiAnalyzer Dashboard loads. You are now in the fully configured management interface.

Devices must be added to FortiAnalyzer before they can send logs. You can add devices manually, or they can be discovered automatically when a FortiGate connects. FortiAnalyzer supports FortiGate, FortiClient, FortiMail, FortiWeb, FortiSwitch, FortiProxy and more.

◈ Add Device Steps

• 1In the FortiAnalyzer GUI, navigate to Device Manager in the top menu
• 2Click Add Device → select FortiGate (or relevant device type)
• 3Enter the device IP address, serial number, and a display name for the device
• 4Click OK to add the device to the FortiAnalyzer inventory
• 5On the FortiGate device, navigate to Log & Report → Log Settings
• 6Under Remote Logging, enable Send Logs to FortiAnalyzer/FortiManager
• 7Enter the FortiAnalyzer port1 IP address and set log level to Information or lower as required
• 8On FortiAnalyzer, the device will appear with a green status dot when logs start flowing
• 9Navigate to Log View → All Logs to verify logs are being received from the device

ADOMs (Administrative Domains) allow you to segment FortiAnalyzer into isolated management zones — separate log views, separate admin access, and separate reports per business unit, customer, or geographic location. Critical for MSPs managing multiple clients, or large enterprises with separate business divisions.

◈ ADOM Configuration Steps

• 1Navigate to System Settings → All ADOMs in the FortiAnalyzer GUI
• 2Click Create New to create a new ADOM
• 3Enter a name, set the device type (FortiGate, FortiMail, etc.), and configure the ADOM version to match your FortiGate firmware
• 4Assign devices to the ADOM by selecting from the device list
• 5Create ADOM-specific administrator accounts with access scoped to that ADOM only
• 6Each ADOM has its own Log View, Reports, Incidents, and Event Management sections — fully isolated from other ADOMs

When a FortiGate IPS fires an alert for a network intrusion, FortiAnalyzer lets you immediately pivot from that single event to the complete attacker activity timeline across your entire network.

• 1Navigate to Log View → Traffic Logs and filter by the source IP from the IPS alert
• 2Expand the time range to show all sessions from that IP over the last 24–72 hours — reveals recon activity that preceded the alert
• 3Pivot to Threat Logs filtered by the same IP — see all IPS, AV and web filter events linked to this attacker
• 4Check Application Control logs to identify what tools or protocols the attacker used post-access
• 5Navigate to Incidents & Events → Correlations to see if FortiAnalyzer has auto-correlated this IP across multiple event types
• 6Generate an Incident Report from FortiAnalyzer's report builder with the full timeline for stakeholder reporting

When a user account is suspected of compromise, FortiAnalyzer allows you to pull all activity associated with that user identity across every device — firewall, VPN, email gateway, web proxy — from a single search.

• 1In Log View, use the search bar to filter by User = <username> across all log types
• 2Review VPN logs — check for login times, source IPs and geolocation anomalies (impossible travel)
• 3Check Web Filter logs for the user — unusual browsing patterns, C2 beacon traffic, or mass file download activity
• 4Review Application Control logs — look for data exfiltration tools (cloud storage uploads, FTP, unusual outbound protocols)
• 5Cross-reference with FortiMail logs if integrated — detect outbound email data exfiltration or phishing sent from the compromised account
• 6Use the FortiView → Sources widget to visualise all traffic originating from the user's IP in a geographic and session view

When FortiGate AV detects malware on a network segment, FortiAnalyzer lets you immediately determine the blast radius — how many devices were affected, what the malware communicated with, and whether it spread laterally.

• 1Navigate to Log View → Security Logs → AntiVirus and filter by the malware name from the alert
• 2Review all Infected Source IPs — this immediately shows every device that triggered the same AV detection
• 3For each infected IP, pivot to Traffic Logs filtered by that IP — identify C2 callback domains and IPs contacted after infection
• 4Use Log View → DNS Logs (if FortiGate DNS logging is enabled) to see all domains resolved by infected hosts around the time of infection
• 5Run a query across all logs for the identified C2 domain/IP — this surfaces any additional hosts contacting the same infrastructure
• 6Generate a Malware Incidents Report showing detection timeline, affected hosts, and C2 destinations for containment and executive updates

After containment, FortiAnalyzer becomes your central source of truth for documenting what happened, how it was detected, and how quickly you responded. This is essential for regulators, executives, and your own lessons‑learned process.

• 1Use Log View filters to export key evidence sets (traffic, threat, VPN logs) as CSV for your case files
• 2In Reports, start from a built‑in template (e.g. Top Threats, Security Incidents) and customise with incident‑specific filters
• 3Include FortiView widgets (Top Sources, Top Destinations, Compromised Hosts) as charts in your report
• 4Schedule a recurring report for the next 30–60 days to monitor for any re‑occurrence of the same indicators
• 5Archive the final PDF/HTML reports and exported logs in your case management system as immutable evidence