FortiSIEM 500G Collector
Collector node — 8,000 events per second
- Performance
- 8
- Max UEBA users
- N/A
- Role
- Collector
The FSM-500G is a collector: it gathers events at the edge of a site or network segment and forwards them to a supervisor for correlation. Benchmarked at 8,000 EPS with 500 SNMP and 200 WMI for performance monitoring.
A collector, not a supervisor — it gathers events at the edge of a site or segment and forwards them for correlation, benchmarked at 8,000 EPS with 500 SNMP and 200 WMI for performance monitoring. Count your sites and network segments when sizing, not just total event volume: a single central supervisor with no collectors will struggle to reach devices across a distributed estate.
Highlights
- 8,000 EPS, 500 SNMP, 200 WMI for performance / 100 WMI for logs
- Edge collection for distributed estates
- CMDB attaches every alert to a known asset
- Correlates Fortinet and third-party sources together
Typical deployments
- Edge collection at branch or regional sites
- Scaling an existing FortiSIEM deployment horizontally
- Segments where direct supervisor reach is not practical
What this includes
Fortinet publishes no throughput table for this product — it is licensed per user, endpoint, workload or account. What follows is capability and sizing, not benchmarks.
Performance
| Performance benchmark | 8,000 EPS, 500 SNMP, 200 WMI for performance / 100 WMI for logs |
|---|---|
| Recommended max. UEBA users | N/A |
| Role | Collector |
Sources
- Fortinet Product Matrix (July 2026) — retrieved 2026-09-01
Reproduced from Fortinet published documentation and subject to change without notice. Where a figure is load-bearing for your design, ask us to confirm it in writing before you order — we will.