Fortianalyzer Cloud with SOCaaS

[yaseen330]

Hello

I've been trying to get information on the SOCaaS product offering and have checked the ordering guide here: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/og-managed-soc-services.pdf

The subscription service is per firewall however there is no information on whether you have to two licences if the firewalls are in an HA cluster. It does not make sense to buy x2 licences as the logs are being sent from the FAZ for the cluster (which is seen as one device)

[gfleming]

Pretty sure you’ll need two licenses. What happens if primary goes down and secondary is up? You’ll lose your logging.