Which teams benefit most from this integration?
It is especially valuable for SOC teams, MSSPs, and organizations using FortiGate while also needing endpoint behavior in context.
Integration
Wazuh FortiGate integration
Seeing endpoint signals and firewall sessions in the same context brings major advantages for lateral movement detection and validated incident analysis.
How it is combined
Wazuh agent data provides host and process context, while FortiGate session data completes the source-destination flow. The two streams are matched through common user, IP, time, and asset fields.
Outcome
This approach leads to faster root-cause analysis than looking at firewall logs or endpoint events in isolation.