FA-An FortiAnalyzer Analyst (NSE5) - FG09

This course will help:

Gain practical skills as a SOC analyst using FortiAnalyzer for centralized logging and analytics
Identify current and potential threats through incident analysis and outbreak reports
Incorporate FortiAI into your workflow and generate security reports
Prepare for the Fortinet NSE 5 certification exam

Pre-requisites:

This course assumes that participants have completed the FortiGate Operator and FortiAnalyzer Administrator courses or have equivalent practical experience. Basic knowledge of SQL SELECT statement syntax is also required.

Course syllabus:

SOC Concepts and Security Fabric
Log Data Flow and Navigation
Events, Indicators, and Incidents
FortiAI, Threat Hunting, and Troubleshooting
Reports
Playbooks

You will learn:

Describe SOC objectives, responsibilities, and roles
Describe the role of FortiAnalyzer in a SOC
Describe FortiAnalyzer Security Fabric integration
Describe how logging works in a Security Fabric
Describe FortiAnalyzer Fabric deployments
Describe FortiAnalyzer operating modes
Describe how FortiAnalyzer parses and normalizes logs
Validate log parsers
Search logs using normalized fields
View and search for logs in the log view
Create saved filters and dashboards
View summary data in FortiView
View dashboards and widget features
Configure event handlers
Manage events
Configure indicators
Create incidents
Analyze incidents
Configure incident settings
Describe FortiAI operations and use cases
Describe threat hunting
Use the log count chart
Use the SIEM log analytics table
Describe outbreak alerts
Collect log volume statistics
Configure an automation stitch
Configure an event handler with an automation stitch enabled
Run and fine-tune predefined reports
Customize reports with macros, custom charts, and datasets
Configure external storage for reports
Group reports
Import and export reports and charts
Attach reports to incidents
Manage and troubleshoot reports
Create new playbooks
Use variables in tasks
Monitor playbooks
Export and import playbooks