Licensing

Each FortiGate to be monitored must have a valid FortiCloud SOCaaS subscription.

• If you are using on-premise FortiAnalyzer or FortiAnalyzer Cloud, this subscription is all you need to onboard SOCaaS. Please be sure to review the Ordering Guide for specific directions for adding SOCaaS license to your devices and connecting to the SOCaaS Portal to initiate the onboarding process.

• A complimentary FortiAnalyzer Cloud instance is provided with the SOCaaS license and may be used if customer does not have a FortiAnalyzer on-premise or FortiAnalyzer Cloud instance.

• If you are using FortiAnalyzer Cloud with a FortiAnalyzer Cloud subscription with SOCaaS license for this service, you are automatically entitled to SOCaaS.
  See the FortiAnalyzer Cloud Deployment Guide.

• All FortiGate devices must have a SOCaaS license, including each individual HA cluster node.

• For forwarding FortiSASE logs to SOCaaS, FortiSASE Advanced or FortiSASE Comprehensive subscription including FortiGuard Forensics is required

• To enable forensic analysis, a FortiClient EMS device with a valid FortiClient Forensic Service license must be onboarded to SOCaaS.