Introduction

FortiNDR (On-premise) is Fortinet’s Network Detection and Response product designed for on-premises installations where network metadata remains within the network, supporting OT and air-gapped infrastructure. It is available in various form factors, including appliances, VM/KVM, and public cloud (BYOL), with support for distributed sensors and centers. FortiNDR can classify both network-based and file-based (malware) threats, providing network visibility, including East-West traffic in datacenter/cloud environments. Equipped with Artificial Neural Networks (ANN), it classifies malware into attack scenarios, surfaces outbreak alerts, and traces the source of malware infections. It detects network-based attacks such as intrusions, botnets, compromised IOCs, weak ciphers, and vulnerable protocols. Supervised and unsupervised Machine Learning (ML) continuously analyze metadata across networks to identify threats, with remediation available via Fortinet Security Fabric.