AGENDA

1. Introduction to FortiSOAR
2. System Configuration
3. FortiSOAR Content Configuration
4. User Administration
5. Searching and Incident Response
6. Multi-Tenancy
7. High Availability
8. System Monitoring and Troubleshooting

OBJECTIVES

After completing this course, you should be able to:

• Plan a FortiSOAR deployment
• Identify the role of SOAR in assisting security teams
• Describe incidents and alerts in a SOC environment
• Configure applications
• Manage audit logs
• Export and import a FortiSOAR modular configuration
• Perform a full database backup and restore
• Describe the different types of services in the FortiSOAR Content Hub
• Configure connectors for devices
• Configure connectors through agents
• Configure data ingestion from cybersecurity devices
• Configure data ingestion from external indicator of compromise (IOC) feeds
• Configure role-based access control (RBAC)
• Configure teams
• Configure roles and users
• Configure authentication
• Configure SLA templates
• Configure shift management queues
• Review Elasticsearch basics
• Review FortiSOAR recommendation engines
• Configure Elasticsearch based record similarity
• Configure machine learning (ML)
• Describe how to delegate incidents across different teams
• Configure war rooms
• Describe the different ways to configure FortiSOAR for multiple tenants
• Configure a multi-tenant architecture
• Configure the secure message exchange (SME) server
• Perform operations on a tenant FortiSOAR server
• Identify different high availability (HA) implementation prerequisites and configuration options
• Manage cluster licensing
• Configure HA with an internal or external PostgreSQL database
• Identify HA best practices
• Configure system monitoring and notifications
• Configure the system health check widget
• Configure different levels of logging
• Review FortiSOAR services and processes

SYSTEM REQUIREMENTS

If you take the online format of this class, you must use a computer that has the following:

• A high-speed Internet connection
• An up-to-date web browser
• A PDF viewer
• Speakers or headphones
• One of the following:
• HTML 5 support
• An up-to-date Java Runtime Environment (JRE) with Java Plugin enabled on your web browser

You should use a wired Ethernet connection, not a WiFi connection. Firewalls, including Windows Firewall or FortiClient, must allow connections to the online labs.