FortiSOAR- Engineer's Guide for deployment and Configuration

Learn to download FortiSOAR OVA images from support.com, log in, choose VM type, and deploy on VMware with initial configuration, password changes, and pre-script snapshots.

Register and activate the FortiSOAR license by locating the Uuid, logging into the server GUI, and using the license activation module, with registration to follow.

Register and upload a FortiSOAR license via the Fortinet portals, entering the registration code and device UID, then download the license file and activate the server for a free trial.

Explore the FortiSOAR GUI, from login and password change to navigating left-side modules for shift management, incident response, and playbooks, with data ingestion, dashboards, and reports.

Master the FortiSOAR playbook breakdown, learning to create and trigger playbooks with manual inputs, on create and on update rules, and to use blocks, references, and ginger for testing.

Learn to update an indicator's reputation via a manual playbook, using VirusTotal integration to assess IP reputation and conditionally set good or bad in the indicators module.

Learn to test public versus private IPs using CIDR ranges, trigger a decision in a FortiSOAR playbook, and automatically update IOC reputations as good or malicious.

In FortiSOAR, learn how to configure a playbook that runs on create, automatically checks IP indicators, determines internal versus external IPs, updates reputation, and initiates blocking with approval.

Explore how alerts, indicators, and incidents connect in fortisoar, as playbooks extract indicators from alerts, auto-create and link indicators, and reveal cross‑module correlations.

Configure the FortiSIEM connector to ingest data from 40 sources, map event fields, and run the ingestion playbook with scheduling and one active instance control.

Explain how data ingestion works in FortiSOAR by configuring schedules every 5 or 15 minutes, using last full time and current time macros, and mapping JSON data to alerts.

Learn to optimize the get reputation of IOC manual workflow using a ginger variable. Condense three steps into one, updating only the relevant parameter via API calls.

Explore FortiSOAR loops in playbooks, using the excel connector to read data, preprocess IP addresses, check VirusTotal reputation, and automatically block malicious addresses or email alerts.

Develop and test a phishing incident response playbook that analyzes the sender domain, extracts artifacts from the email body, checks domain reputation with VirusTotal, and updates alerts based on severity.

Configure queue and shift management in FortiSOAR to auto-assign alerts to on-shift analysts using round-robin rules, manage leave and handover, and align with SLAs.

Track and manage SLAs across alerts, incidents, and tasks using SLA templates, trackers, and dashboards, including acknowledgement and response times and how they are met.

Create information gathering playbooks to fetch user details from AD, print results in comments, and update alerts with the username and its reputation.

Set up a live war room for a ransomware incident, assign tasks to L1–L3 analysts, track indicators, artifacts, emails, and assets, and generate a customizable war room PDF report.

Create a custom module, configure fields and queue management, publish it, map roles and users, and add it to the menu for deployment and ingestion via playbooks.

Automate data ingestion into a FortiSOAR custom module using the FortiSIEM connector. Set up and test a module ingest workflow with scheduling and authentication.