

Fortinet FortiAnalyzer and Cribl are prominent competitors in the log management domain with distinct strengths. Fortinet FortiAnalyzer holds an edge in security-focused log analysis and network protection, making it suitable for Fortinet environments, while Cribl shines with its flexible data handling capabilities, appealing to organizations managing extensive data volumes.
Features: Fortinet FortiAnalyzer provides advanced threat analysis, centralized log views, and detailed reporting essential for network security, enhancing its integration with multiple Fortinet devices. Cribl specializes in real-time data transformation, data compression, and multi-destination routing, optimizing data flow and costs across diverse IT setups.
Room for Improvement: Fortinet FortiAnalyzer users identify the need for better user guidance, integration with third-party tools, and competitive pricing. Cribl could improve with more intuitive administrative features, broader community support, and enhanced legacy system integration for seamless operations.
Ease of Deployment and Customer Service: Fortinet FortiAnalyzer's on-premises deployment suits Fortinet-centric infrastructures but faces challenges with technical support responsiveness. Cribl offers cloud flexibility with easy setups and generally favorable customer support, although there are noted cost concerns with scaling.
Pricing and ROI: Fortinet FortiAnalyzer is seen as costly, beneficial primarily for full Fortinet deployments, offering strong ROI in multi-firewall setups despite high licensing fees. Cribl boasts a cost-effective model, showcasing significant savings and scalability compared to pricier competitors.
What we've seen is really an overall reduction of just shy of 40% in our ingest into our SIM platform versus prior to having Cribl.
The second thing is that data aggregation, sampling, and reduction that we're able to do of the data, lowering our overall data volume, both traversing the network as well as what's being stored inside of our final solutions.
In terms of reduction, we were able to save almost ~40% of our total cost.
The impact of the tool is low when the functionalities are inaccessible due to resource consumption.
Fortinet is highly efficient for moderate deployments and provides a secure platform for medium-sized networks and data centers.
I have seen a return on investment with Fortinet FortiAnalyzer due to its competitive pricing and straightforward licensing model based on the amount of log data processed per day.
They had extensive expertise with the product and were able to facilitate everything we needed.
Usually, within an hour, we get a response, and we are able to work with them back and forth until we resolve the issues.
Sometimes by hearing the problem itself, they will know what the solution is, and they will let us know how to resolve it, and we do it immediately.
Customer service and support for Fortinet FortiAnalyzer are quite helpful and responsive.
Technical support is good, and I rate it ten out of ten.
The support service is very slow and incompetent.
The infrastructure behind Cribl Search is also scalable as it uses a CPU and just spawns horizontally more instances as it demands and requires.
Compared to other SIEM tools I use, any slight change on the operating system end impacts a lot on our SIEM tools and other things, but Cribl performs well in that regard.
It's an enterprise version, and we have a good amount of users using this solution.
Fortinet FortiAnalyzer is scalable, especially for the VM versions, as additional space can be provisioned from the servers as needed.
FortiAnalyzer is a scalable product.
It typically handles three to five years of expansion effectively.
Migrating from those SC4S servers to Cribl worker nodes has truly been a game-changer.
Regarding scalability, we started with zero servers and have around 285 servers now.
I would rate the stability as ten out of ten.
We faced some CPU consumption issues, which caused the machine to slow down and required a restart of FortiAnalyzer.
It remains stable during implementation for one or two years.
It provides a reliable solution for managing network-wide data.
A more stringent role-based access control feature would enhance security and allow granular control over what users can see and access.
If we can have more internal logs and more debug logs to validate the error, that would be beneficial because instead of reaching out to Cribl support, we can troubleshoot and find the root cause ourselves.
In terms of large datasets—whether they originated from network inputs, virtual machines, or cloud instances—ingesting the data into the destination was relatively easy.
When licensing, each device is licensed separately, such as the firewall, which can become expensive.
This would help in analyzing various security incidents and events more effectively by delivering a handful of relevant logs instead of thousands.
Enhanced deep inspection features would make troubleshooting easier.
Over time, the licensing cost has increased.
Cribl is very inexpensive, with enterprise pricing around 30 cents per GB, which is really decent.
They have a universal license that allows us to consume the portions of Cribl that we want to use or flex into other portions of Cribl.
Its licensing model is based on the amount of log data processed per day, making it more cost-effective compared to QRadar, which is EPS and device-based.
In terms of pricing, FortiAnalyzer is not expensive.
In the Indian market, Fortinet's pricing is very competitive, allowing us to win most of our deals.
The data reduction and preprocessing capabilities make Cribl really unique.
Cribl has a feature called JSON Unroll or Unroll function that allows you to differentiate the events; each event will come ingested as a single log instead of piling it up with multiple events.
The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after.
The advanced analytics capabilities aid in threat detection by providing visibility into indicators of compromise.
The most valuable feature of Fortinet FortiAnalyzer is its ability to simplify and display logs clearly, providing details like which IPs are accessing the system, the destination, and the policies applied.
The log management is useful as we have connected around two hundred eighty-five walls and around fifteen to twenty plus firewalls with Fortinet FortiAnalyzer, making it highly beneficial compared to logging into each individual firewall.
| Product | Market Share (%) |
|---|---|
| Cribl | 2.6% |
| Fortinet FortiAnalyzer | 1.7% |
| Other | 95.7% |


| Company Size | Count |
|---|---|
| Small Business | 9 |
| Midsize Enterprise | 5 |
| Large Enterprise | 18 |
| Company Size | Count |
|---|---|
| Small Business | 58 |
| Midsize Enterprise | 20 |
| Large Enterprise | 31 |
Cribl offers advanced data transformation and routing with features such as data reduction, plugin configurations, and log collection within a user-friendly framework supporting various deployments, significantly reducing data volumes and costs.
Cribl is designed to streamline data management, offering real-time data transformation and efficient log management. It supports seamless SIEM migration, enabling organizations to optimize costs associated with platforms like Splunk through data trimming. The capability to handle multiple data destinations and compression eases log control. With flexibility across on-prem, cloud, or hybrid environments, Cribl provides an adaptable interface that facilitates quick data model replication. While it significantly reduces data volumes, enhancing overall efficiency, there are areas for improvement, including compatibility with legacy systems and integration with enterprise products. Organizations can enhance their operational capabilities through certification opportunities and explore added functionalities tailored towards specific industry needs.
What are Cribl's most important features?Cribl sees extensive use in industries prioritizing efficient data management and cost optimization. Organizations leverage its capabilities to connect between different data sources, including cloud environments, improving both data handling and storage efficiency. Its customization options appeal to firms needing specific industry compliance and operational enhancements.
Fortinet FortiAnalyzer is a powerful platform used for log management, analytics, and reporting. The solution is designed to provide organizations with automation, single-pane orchestration, and response for simplified security operations, as well as proactive identification and remediation of risks and complete visibility of the entire attack surface.
Fortinet FortiAnalyzer Features
Fortinet FortiAnalyzer has many valuable key features. Some of the most useful ones include:
Fortinet FortiAnalyzer Benefits
There are many l benefits to implementing Fortinet FortiAnalyzer. Some of the biggest advantages the solution offers include:
Reviews from Real Users
Below are some reviews and helpful feedback written by PeerSpot users currently using the Fortinet FortiAnalyzer solution.
PeerSpot user Imad A., Group IT Manager at a manufacturing company, says, “You can monitor all appliances from a centralized location. You have a front dashboard for all our operations and all the logs. If you need to search for anything you can just dig deep into the logs. The solution offers excellent customizable reports. In our case, we needed a monthly report of all internet consumption, and we were able to easily create this.” He goes on to add, “There are pre-defined templates. The logs cover any question or need that we populate within these templates. However, you can also build your own template. There is great analytics that can be used in different departments. For example, our marketing department can go more into media patterns and not just into browsing patterns. Everything is easily visible and can be tracked and studied.”
Luis G., Systems Architect at Zentius, mentions, “Log collection is the most valuable [feature]. The UI looks great. It has a very good look and feel. We don't have the need to use solid state drives. We use mechanic drives, and we don't see any performance issues, so basically, it is doing fine.”
Rupsan S., Technical Presales Engineer at Dristi Tech Pvt.ltd., comments, "The feature that I have found the most valuable is to be able to see everything in our network in a single task. A single menu and the graphical bar charts that it provides to give insights are very useful. It also gives very good metrics on bandwidth utilization, CPU, and device performance. It is very simple and easy to use as well."
Dilip S., Regional Head at Mass Infonet (P) Ltd., explains, “With FortiAnalyzer, you can see what the user is doing and what sites he goes to. You can also see how much quota there is and how much (size-wise) you want to hit, as well as what the incoming or outbound traffic is, and if it is through the ISP or not. Basically, you can see absolutely all activity using FortiAnalyzer. The solution is very complete. The product is very simple to use. It's regularly updated with many versions constantly adding more content and information. The solution has sandboxing, IPS, and DPS as well. The solution allows for a lot of customization.”
We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.