FortiSOAR Shift Management and Reporting

Queue & Shift Management

• FortiSOAR allows creating shift rosters with shift leads and team members
• Queues allow users to view assigned tasks, pending tasks, and task priority
• Records are assigned to users within a queue, and shift-based assignment can be enabled to assign them to only users who are working

Dashboard

• Dashboards are the default landing page for FortiSOAR users
• Personalized dashboards can be created based on user roles
• Dashboard customizations are only visible and applicable to the individual user
• Administrators must update the dashboard for changes to apply to all users

Reporting

• Users have the option to use default report templates or create their own
• Reports can be scheduled, viewed historically, and text can be searched within the PDF report
• Reports can be previewed before scheduling

SOC Optimization

• Alerts are triaged and checked to verify if the alert is legitimate
• Triaging and checking alerts is done by automatically extracting indicators and checking their reputation against threat intelligence platforms
• FortiSOAR automates repetitive and monotonous elements of SOC workflows, freeing analysts to focus on incident response and larger-picture cyber defense strategies

SOC Alert Handling & Triage

• SOC teams handle alerts and proceed through a process of triage and escalation
• The SOC Automation Model is divided into three key areas: people, process, and product
• Each area is classified at a maturity level from 1-3, based on the organization's security posture

FortiSOAR Architecture

• FortiSOAR supports multi-tenant models with a primary node and tenant nodes
• The primary node requires only a summary of information to identify investigations
• The primary node pushes any action needed to be executed to the tenant node
• FortiSOAR supports HA clusters in both active-passive and active-active configurations
• A secure message exchange server can be deployed externally or embedded on each FortiSOAR node
• For production environments, it is recommended to use an external secure message exchange server for increased scalability and availability

FortiSOAR Features

• FortiSOAR allows users to escalate alerts, which become incidents
• Analysts can work on incidents until closure
• FortiSOAR's queue management feature provides an overview of pending work and allows users to reassign tasks
• Administrators can create dashboards based on user roles to help prioritize tasks
• Users can be granted access to specific modules within FortiSOAR using role-based access control (RBAC)
• User RBAC permissions are aggregated from all assigned roles

Content Hub

• The Content Hub acts as a central repository for connectors, widgets, and solution packs
• Content in the hub is updated hourly by synchronization from the FortiSOAR repository

Roles

• Roles can be defined and modified within FortiSOAR
• It is essential to assign roles with read permissions for the Application, Audit Log Activities, and Security modules to users who need to work with FortiSOAR
• Roles are not hardcoded and therefore must be carefully managed by administrators
• CRUD model permissions are used to define roles and control access within modules
• Users can be assigned multiple roles, and permissions are aggregated from each assigned role

Security Administrator Role

• The Security Administrator role has full CRUD permissions on the Security module, allowing for the management of roles and teams
• This role also has CRUD permissions on the Secure Message Exchange and Tenants modules for multi-tenant configurations
• It is recommended to only assign this role to users with responsibility for managing role and team structure and to avoid removing the role.

This quiz covers key features of FortiSOAR, focusing on shift and queue management, personalized dashboards, and reporting capabilities. Learn how to optimize your SOC operations by exploring alert triage and reporting tools. Test your knowledge on these essential functionalities for effective security operations.