FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
This article explains how to use the marketplace "Template deployment" option for FortiAnalyzer in Azure Marketplace.

Install the FortiAnalyzer machine on MS Azure.

Access the Azure portal and sign in with an Azure account that has administrative privileges:
  • In the left navigation pane, select (+) New
  • In the "search the marketplace" enter "template"
  • Select "Template deployment"
  • In the "Results" section returned, select "Template deployment"
  • Select "Create"
From the "Deploy from a custom template" section:
  • Select "Edit"
  • Go to
  • Copy the contents of this JSON file (All 340 lines of code)
  • Paste this content into the "Edit template" section, replacing the contents that is already there (6 lines of code)
  • Select "Save"
  • Complete the parameters (which are environment specific variables)
Once the required information has been entered and completed:
  • Select "I agree to the terms and conditions stated above"
  • Select "Pin to dashboard"
  • Select "Purchase"