FortiSOAR Analyst

  • Duration: 3 days (18 hours)
  • Date: on request

FortiSOAR Analyst

This course will help:
  • Gain foundational knowledge and skills in using FortiSOAR to orchestrate and automate cybersecurity operations
  • Learn how to integrate security tools and network devices, as well as facilitate collaboration during incident response
  • Learn how to design and use playbooks to automate workflows and route decisions based on input data
  • Learn how to automate threat intelligence enrichment and response actions
  • Develop skills in working with indicators of compromise (IoCs) to effectively detect and respond to threats
  • Prepare for the Fortinet NSE 6 certification exam
Sign up for a course
Add to cart

Course syllabus:

  • Introduction to FortiSOAR
  • SOC Playbook Development
  • Jinja, Dynamic Variables, and Dynamic Values
  • Application Editor
  • Templates, Dashboards, and Widgets
  • Controlling Playbook Logic
  • Querying and Transforming Data
  • Incident Handling and FortiSOAR
  • Troubleshooting Playbooks and Connectors
  • Working With APIs

You will learn:

  • Describe SOAR, SIEM, automation, and orchestration
  • Describe modules, deployment models, and FortiSOAR device types
  • Navigate the FortiSOAR GUI
  • Customize navigation with the navigation editor
  • Describe the SOAR Framework solution pack
  • Describe templates, dashboards, and reports
  • Describe security management, role-based access, and teams
  • Describe FortiSOAR playbook triggers
  • Describe FortiSOAR playbook steps
  • Create a playbook
  • Ingest data from FortiSIEM
  • Create preprocessing rules
  • Describe Jinja and JSON, and how FortiSOAR uses them
  • Describe dynamic variables and values
  • Describe built-in functions
  • Design and publish a module
  • Export and import FortiSOAR entities
  • Configure dashboards
  • Configure widgets in templates
  • Apply operators to evaluate conditions
  • Demonstrate the JSON and YAQL query filters
  • Describe FortiSOAR incidents
  • Describe campaigns
  • Describe the MITRE ATT&CK Matrix for Enterprise
  • Describe incident phases on FortiSOAR
  • Describe the incident handling workflow on FortiSOAR
  • Configure shift and queue management
  • Configure war rooms
  • Troubleshoot common playbook issues
  • Troubleshoot common connector issues
  • Configure logging levels and log files for analysis
  • Describe API basics
  • Configure the FortiSOAR API
  • Configure FortiManager API integration with FortiSOAR
  • Describe FortiAI on FortiSOAR

Pre-requisites:

This course assumes the following knowledge:

  • Knowledge of the topics covered in the FortiOS Administrator course, or equivalent work experience
  • Knowledge of the topics covered in the FortiManager Administrator course, or equivalent work experience
  • Knowledge of the topics covered in the FortiSOAR Administrator course, or equivalent work experience
  • Basic Python programming skills
  • Basic knowledge of the Jinja2 templating language
  • A basic understanding of email security technologies and SIEM systems
Sign up for a course FortiSOAR Analyst