FortiSOAR Analyst - FG14

This course will help:

Gain foundational knowledge and skills in using FortiSOAR to orchestrate and automate cybersecurity operations
Learn how to integrate security tools and network devices, as well as facilitate collaboration during incident response
Learn how to design and use playbooks to automate workflows and route decisions based on input data
Learn how to automate threat intelligence enrichment and response actions
Develop skills in working with indicators of compromise (IoCs) to effectively detect and respond to threats
Prepare for the Fortinet NSE 6 certification exam

Pre-requisites:

This course assumes the following knowledge:

Knowledge of the topics covered in the FortiOS Administrator course, or equivalent work experience
Knowledge of the topics covered in the FortiManager Administrator course, or equivalent work experience
Knowledge of the topics covered in the FortiSOAR Administrator course, or equivalent work experience
Basic Python programming skills
Basic knowledge of the Jinja2 templating language
A basic understanding of email security technologies and SIEM systems

Course syllabus:

Introduction to FortiSOAR
SOC Playbook Development
Jinja, Dynamic Variables, and Dynamic Values
Application Editor
Templates, Dashboards, and Widgets
Controlling Playbook Logic
Querying and Transforming Data
Incident Handling and FortiSOAR
Troubleshooting Playbooks and Connectors
Working With APIs

You will learn:

Describe SOAR, SIEM, automation, and orchestration
Describe modules, deployment models, and FortiSOAR device types
Navigate the FortiSOAR GUI
Customize navigation with the navigation editor
Describe the SOAR Framework solution pack
Describe templates, dashboards, and reports
Describe security management, role-based access, and teams
Describe FortiSOAR playbook triggers
Describe FortiSOAR playbook steps
Create a playbook
Ingest data from FortiSIEM
Create preprocessing rules
Describe Jinja and JSON, and how FortiSOAR uses them
Describe dynamic variables and values
Describe built-in functions
Design and publish a module
Export and import FortiSOAR entities
Configure dashboards
Configure widgets in templates
Apply operators to evaluate conditions
Demonstrate the JSON and YAQL query filters
Describe FortiSOAR incidents
Describe campaigns
Describe the MITRE ATT&CK Matrix for Enterprise
Describe incident phases on FortiSOAR
Describe the incident handling workflow on FortiSOAR
Configure shift and queue management
Configure war rooms
Troubleshoot common playbook issues
Troubleshoot common connector issues
Configure logging levels and log files for analysis
Describe API basics
Configure the FortiSOAR API
Configure FortiManager API integration with FortiSOAR
Describe FortiAI on FortiSOAR