FortiSIEM 2200G Supervisor
Supervisor node — 20,000 EPS with collectors
- Performance
- 20
- Max UEBA users
- 10,000
- Role
- Supervisor
The FortiSIEM 2200G Supervisor correlates events across the estate at 20,000 EPS with collectors, with a recommended maximum of 10,000 UEBA users. It maintains a CMDB so an alert arrives attached to the asset it concerns rather than to an IP address someone has to look up.
A supervisor at 20,000 EPS with collectors and a recommended maximum of 10,000 UEBA users. Size on PEAK events per second measured during an incident, when every device is logging hard — that is exactly when a SIEM must not drop events, and it is when under-sized deployments fail. Averages will mislead you here.
Highlights
- 20,000 EPS with collectors
- Up to 10,000 UEBA users
- CMDB attaches every alert to a known asset
- Correlates Fortinet and third-party sources together
Typical deployments
- Mid-size enterprises building a SOC capability
- Cross-vendor correlation beyond what FortiAnalyzer reports on
- Deployments needing UEBA on privileged accounts
What this includes
Fortinet publishes no throughput table for this product — it is licensed per user, endpoint, workload or account. What follows is capability and sizing, not benchmarks.
Performance
| Performance benchmark | 20,000 EPS with collectors |
|---|---|
| Recommended max. UEBA users | 10,000 |
| Role | Supervisor |
Sources
- Fortinet Product Matrix (July 2026) — retrieved 2026-09-01
Reproduced from Fortinet published documentation and subject to change without notice. Where a figure is load-bearing for your design, ask us to confirm it in writing before you order — we will.