FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Nur
Staff
Staff
Article Id 395993
Description

This article describes how to create a FortiAnalyzer instance using CLI via Google ShellBasically.

Scope FortiAnalyzer and GCP.
Solution
  1. Download the image from the support portal (choose new development):

 

Screenshot 2025-06-13 081718.png

 

  1. Go to Google Cloud -> Search -> Bucket and select 'Create New':

 

Screenshot 2025-06-12 130957.png

 

  1. Select the bucket created, choose 'Upload', and upload the image downloaded from the support portal.

 

Screenshot 2025-06-12 131119.png

  1. Go to Google Shell to run gcloud config:

 

Screenshot 2025-06-12 131344.png

 

  1. Create an Image of FortiAnalyzer.

 

project=XXXXXX-XXX-testing << Source of GCP
bucket=nurXXXX <<< The bucket just created
source_image=FAZ_VM64_GCP-v7.6.3.F-buildXXX-FORTINET.out.gcp.tar.gz << Image upload to bucket
image_name=fortianalyzer-vm-image << Instance Name

 

  1. Run the Image of FortiAnalyzer.

 

gcloud compute images create $image_name \
--project=$project \
--source-uri=https://storage.googleapis.com/$bucket/$source_image \
--storage-location=XXX > Bucket storage location

 

Output:

 

Created [https://storage.googleapis.com/XXXXXXXXXXX]

Name: fortianalyzer-vm-image

Project:

Family:

Deprecated:

Status:READY

 

  1. Create a FortiAnalyzer instance:

 

project=<your project id>
zone=<Choose region>
serviceaccount=<your service account>
image_name=fortigate-vm-image
image=projects/$project/global/images/$image_name

 

  1. Run FortiAnalyzer.

 

gcloud compute instances create doc-fortianalyzer-vm \
--project=$project \
--zone=$zone \
--machine-type=n2d-standard-2 \
--network-interface=private-network-ip=10.0.X.XX,subnet=test,no-address \
--can-ip-forward \
--service-account=$serviceaccount \
--scopes=https://www.googleapis.com/auth/cloud-platform \
--create-disk=auto-delete=yes,boot=yes,device-name=fortianalyzer-vm-boot,image=$image,mode=rw,size=10,type=projects/$project/zones/$zone/diskTypes/pd-balanced \
--create-disk=auto-delete=yes,device-name=fortianalyzer-vm-log,mode=rw,size=10,type=projects/$project/zones/$zone/diskTypes/pd-balanced

 

NAME: fortianalyzer-vm
ZONE: asia-east1-a
MACHINE_TYPE: n2d-standard-2
PREEMPTIBLE:
INTERNAL_IP: 10.0.X.XX
EXTERNAL_IP:
STATUS: RUNNING

 

Screenshot 2025-06-12 132937.png