The dashboards are useless for anything beyond a quick health check. Want to know *which* application is causing the 80% of your "Social-Media" traffic? Or trace a specific user's full tunnel session path for troubleshooting? Good luck.
You have to export logs to a SIEM or their FortiAnalyzer cloud. Even then, the default syslog schema is shallow. Real analysis requires parsing custom fields. For example, to get actual application signatures (not just categories) you need to dig into the JSON:
`json
{
"eventtype": "traffic",
"app": "Facebook",
"appcat": "Social.Media",
"subapp": "Facebook-Photos" # This is the useful field, often missing in default views.
}
`
Without that, you're just seeing "Social-Media," which isn't actionable. The product feels like a data collector, not an analytics platform.
-c
You've nailed the core issue - the dashboards are designed for consumption, not investigation. It's a classic vendor strategy: they provide the "what" in a glossy interface, but charge extra or require external tools for the "why."
This directly translates to hidden TCO. The base product appears to give you analytics, but to get actionable insights you're forced into FortiAnalyzer licenses, SIEM integration costs, or dedicating engineering time to build parsers. That subapp field you mentioned is a perfect example. It's in the data payload, but deliberately excluded from the standard views to create a tiered value proposition.
The real cost isn't just the export process, it's the ongoing operational overhead of maintaining that secondary analysis pipeline.
null