Fortinet FortiNDR Cloud 900G
Network Detection and Response

Click here to jump to more pricing!

Overview:

Fortinet’s SaaS-based FortiNDR Cloud leverages artificial intelligence (AI) and machine learning (ML), behavioral, and human analysis to inspect network traffic to detect malicious behavior early while reducing false positives. FortiNDR Cloud provides unified network traffic visibility across multi-cloud and hybrid environments as well as distributed workforces and constrained, mission-critical environments.

FortiNDR Cloud automatically identifies anomalous and malicious behavior, provides risk scores, and shares relevant threat intelligence to assist security teams in prioritizing response efforts.

As the world’s only Guided-SaaS NDR, FortiNDR Cloud provides dedicated Technical Success Manager (TSM) support. TSMs act as trusted advisors who share findings, tune configurations, and help organizations optimize NDR deployments.

Highlights

• 365-day historical deep network traffic visibility and analytics
• Curated threat intelligence, powered by FortiGuard Labs, for reduced false positives
• Fortinet Security Fabric and third-party integrations
• Leverage AI, expert analysis, and cloud compute for threat detection
• Coverage for over 90% of MITRE ATT&CK techniques

Highlights:

Basic Competencies

Improved Visibility of Threats

Real-time, automated investigation of network security incidents and extended historical network visibility enable a faster, more comprehensive response to threats. Because the impact of an intrusion increases over time, real-time response is the best way to minimize damage.

Get Expertise on Demand

FortiNDR Cloud helps security teams overcome the skills gap challenge by providing Technical Success Manager (TSM) support. TSMs act as trusted advisors who share findings, tune configurations, and help organizations optimize NDR deployments.

Fewer Distractions from False Positives and Detection Tuning

With threat analysis and detection tuning provided in real-time, organizations are less vulnerable while awaiting a vendor’s application patch or anti-malware signature.

365-day Data Retention for Retrospective Analysis and Threat Hunting

FortiNDR Cloud retains rich network metadata for 365 days, enabling a comprehensive investigation. This data ensures newly discovered tools, tactics, and procedures can be retroactively investigated to discover if and when threats may have infiltrated the customer’s network.

Key Features

• Guided SaaS with trusted advisors
• 365-day data retention for retrospective analysis and threat hunting
• Hunt adversaries with Guided Queries
• Automatic and manual response for quarantine and control
• Orchestrated response with integrations with Fortinet and third party tools including CrowdStrike, FortiEDR, Splunk, Cortex, FortiSIEM, FortiSOAR, and Microsoft Sentinel
• Global crowdsourced threat intelligence from numerous third-party feeds and proprietary sensors

Deployment:

Features	FortiNDR Cloud
Deployment	SaaS
Security Analyst	Guided-SaaS with TSM* (Technical Success Manager)
Data Storage Location	Cloud-based (US or EU)
Data Retention	365 Days
Investigation / Threat Hunting	Guided Queries and Parallel Hunting
Malware Identification	FortiGuard Malware feed; VirusTotal lookup
MITRE ATT&CK Framework Mapping	Detections and Playbooks mapped to MITRE ATT&CK Framework
Response Integration	Fortinet Security Fabric Third-party API (Rest) MetaStream (AWS S3) Integrations include CrowdStrike Falcon EDR, FortiEDR, FortiSIEM, FortiSOAR, Cortex, Splunk, QRadar, Microsoft Sentinel, FortiGate, and Crowdstrike SIEM
Sensors	Hardware: FortiNDR Cloud-2540G (Extra Large sensor) Hardware:FortiNDR Cloud-900G (Large sensor) Hardware: FortiNDR Cloud-500G (Small sensor) Virtual Sensors (AWS / Azure / ESXi / HyperV / GCP / KVM)
FortiGuard Labs Threat Research	Yes

* for customers over 1Gbps

Specifications:

	FNDR Cloud 500G	FNDR Cloud 900G	FNDR Cloud 2540G	FNDR Cloud
Category	Small Sensor	Large Sensor	Extra Large Sensor	Virtual Sensors
Deployment
Sniffer / SPAN / 802.1q support
Cloud based sensors + SaaS porta
Hypervisor Support	—	—	—	ESXi6.7 U2+, KVM, HyperV, GCP, AWS, Azure
Hardware Specifications
Total Interfaces	2x 10/25GbE SFP28 4x 1GbE RJ45 2x 10GbE RJ45	2x 10/25GbE SFP28 4x 1GbE RJ45 2x 10GbE RJ45	1x 1GbE RJ45 (mgmt), 2x 10GbE SFP+, 2x 25GbE SFP28, 1x Console (RJ45)	1 mgmt + min 1 TAP
Sniffer Interfaces	3 x 1Gbps (1Gbps Ethernet RJ45) 2 x 10Gbps (10Gbps Ethernet RJ45) 2 x 10/25GbE SFP28 (supports SFP+ SR/LR for 10Gbps and SFP28 SR transceivers for 25Gbps)	3 x 1Gbps (1Gbps Ethernet RJ45) 2 x 10Gbps (10Gbps Ethernet RJ45) 2 x 10/25GbE SFP28 (supports SFP+ SR/LR for 10Gbps and SFP28 SR transceivers for 25Gbps)	2x 10GbE SFP+ 2x 25GbE SFP28 (breakout cable supported)	min 1 x vNIC max 3 x vNIC
Transceivers Included	purchase separately	purchase separately	purchase separately	—
Storage Capacity	2 x 1.6TB	2 x 1.6TB	3.84TB (4x 960GB 2.5” NVMe SSD)	100 (min) - 300 GB (recommended)
Default RAID level (RAID software)	RAID 1	RAID 1	10	Hypervisor dependent
Removable Hard Drives	Yes	Yes	Yes	—
Redundant Hot Swappable Power Supplies	Yes	Yes	Yes	—
Technical Specifications
vCPU Support (Recommended)	—	—	—	16
Memory Support (Minimum / Recommended)	—	—	—	16 GB / 32 GB
System Performance
NDR Sniffer Throughput* (metadata processing across all ports)	14 Gbps (enterprise mix)	18 Gbps (enterprise mix)	38 Gbps (enterprise mix)	Hypervisor dependent
Malware Lookups	Hash lookup (Virus Total) and FortiGuard Malware Feed	Hash lookup (Virus Total) and FortiGuard Malware Feed	Hash lookup (Virus Total) and FortiGuard Malware Feed	Hash lookup (Virus Total) and FortiGuard Malware Feed
Dimensions
Height x Width x Length (mm)	42.8 x 482 x 809.04	42.8 x 482 x 809.04	88 x 483 x 740.8 mm with handle 88 x 438 x 695.8 mm w/o handle	—
Weight	17.23 kg / 38 lbs	17.23 kg / 38 lbs	18.14 kg	—
Environment
AC Power Supply	100-240 VAC, 50/60 Hz, 12-6.3A	100-240 VAC, 50/60 Hz, 12-6.3A	100-240 VAC, 60-50 Hz	—
Power Consumption (Average/ Maximum)	350 W / 500 W	455 W / 685 W	524.8 W / 682.2 W	—
Heat Dissipation	1706 (BTU/h)	2337.3 (BTU/h)	2327.8 BTU/h	—
Operating Temperature	10°C to 35°C (50°F to 95°F)	10°C to 35°C (50°F to 95°F)	0°C to 40°C (32°F to 104°F) with no direct sunlight on the equipment	—
Storage Temperature	-40 to 65°C (-40 to 149°F)	-40 to 65°C (-40 to 149°F)	–20°C to 70°C (–4°F to 158°F)	—
Humidity	Op: 8%RH with -12°C minimum dew point to 80%RH with 21°C (69.8°F) maximum dew point; Non-Op: 5% to 95%RH with 27°C (80.6°F) maximum dew point.		5% to 90% RH with 33°C (91°F) maximum dew point. Atmosphere must be non-condensing at all times. Operating: 10% to 80% relative humidity with 29°C (84.2°F) maximum dew point	—
Operating Altitude	10,000ft / 3048m	10,000ft / 3048m	Up to 10,000 ft (3048 m)	—
Compliance
Certifications	FCC, ISED, CE, RCM, VCCI, BSMI (Class A), UL/cUL, CB	FCC, ISED, CE, RCM, VCCI, BSMI (Class A), UL/cUL, CB	FCC, ISED, CE, RCM, VCCI, BSMI (Class A), UL/cUL, CB	—

* Using FortiTester default Enterprise Profile

Documentation:

Download the Fortinet FortiNDR Cloud Datasheet (PDF).

Pricing Notes:

• Sandbox Threat Intelligence (Antivirus, IPS, Web Filtering, File Query, Industrial Security, SandBox Engine) plus FortiCare Premium
  FortiCare Premium Ticket Handling, Advanced Hardware Replacement (NBD), Firmware and General Upgrades, Antivirus, IPS, Web Filtering, File Query, Industrial Security, SandBox Engine. Does not include Windows or MS Office licenses i.e. BYOL
• Hardware plus FortiCare Premium, with NDR and ANN engine updates & baseline
  Hardware Unit, FortiCare Premium Ticket Handling, Advanced Hardware Replacement (NBD), Firmware and General Upgrades, NDR & ANN Updates, Advanced Malware Protection, IPS, AV, Botnet IP/Domain, and Web filtering, IOT & IOC detection
• FortiCare Premium with NDR and ANN engine updates & baseline
  FortiCare Premium Ticket Handling, Advanced Hardware Replacement (NBD), Firmware and General Upgrades, NDR & ANN Updates, Advanced Malware Protection, IPS, AV, Botnet IP/Domain, and Web filtering, IOT & IOC detection
• FortiCare Premium Support
  FortiCare Premium Ticket Handling, Advanced Hardware Replacement (NBD), Firmware and General Upgrades
• Prices are for one year of Premium RMA support. Usual discounts can be applied.
• Annual contracts only. No multi-year SKUs are available for these services.
• Contact Fortinet Renewals team for upgrade quotations for existing FortiCare contracts.
• Pricing and product availability subject to change without notice.