Is there any difference between the fortiguard database in FGT and in FAZ ?

[Jack_wack]

Our fortigate FGT already matches on fortiguard threats DB. Including IOC threats.

Our fortianalyzer FAZ is asking for an IOC license to be able to analyze these particular threats.

Is the fortiguard DB more updated in FAZ than FGT ?

Why would i buy ICP license in FAZ when it's already there in FGT ?

[esalija · Accepted solution]

Hi @Jack_wack 

The FortiGuard database in FortiGate is primarily used for real-time security services such as antivirus, intrusion prevention, web filtering, and antispam. It helps FortiGate devices protect the network by identifying and blocking threats.

The FortiGuard database in FortiAnalyzer is more focused on analytics and reporting. It collects and analyzes data from FortiGate devices and other sources to provide insights into network security events, traffic patterns, and potential threats.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/42459/fortiguard

Best regards,

Erlin

[spoojary]

e reason you would buy an IoC license for FortiAnalyzer even though it's already present in FortiGate is that FortiAnalyzer offers advanced analysis and reporting capabilities specifically tailored for IoC threats. FortiAnalyzer can provide in-depth visibility, historical data analysis, and reporting on IoC threats detected by FortiGate, helping with incident response, forensic analysis, and compliance requirements.

[spoojary]

https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/137635/viewing-indicator...

https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/322713/fortiguard