FortiSoC Dashboard Mastery

FortiSoC Dashboards

• The Events Dashboard tracks all events, their status, sources, and severity.
• The Incidents Dashboard tracks all incidents that need to be solved, and their severity.
• The Events Dashboard displays information about events, including their status, sources, and severity.
• The Incidents Dashboard includes information about incidents, including their severity and the number of incidents still being handled by analysts.
• FortiSoC dashboards are customizable.
• The information on the FortiSoC dashboards is updated in real-time.
• The Events Dashboard helps the SOC team identify trends, patterns, and anomalies in events.

Playbooks and Incidents

• The Overview Dashboard provides a general overview and statistics about events, incidents, and playbooks in your environment.
• The purpose of the FortiSoC dashboards is to provide a centralized view of security events and incidents.
• Users can get more detail about a section of interest on the dashboards by clicking on it.
• The Incidents Dashboard provides a clear representation of incident severity and the number of incidents still being handled by analysts.

Playbooks

• The Playbooks Dashboard tracks playbooks executed in the environment.
• In the example shown, 15 playbooks have been executed in the last seven days.
• The responsibility of the SOC analyst is to review and execute playbooks.

FortiAnalyzer

• Events are generated in FortiAnalyzer based on log data from various sources.
• The purpose of event handlers in FortiAnalyzer is to filter and process events.
• Predefined event handlers in FortiAnalyzer can be cloned and modified to create custom event handlers.
• The matching criteria for event handlers in FortiAnalyzer include event type, severity, and source.
• Individual filters in event handlers can be used to filter events based on specific criteria.
• All generated events can be viewed in FortiAnalyzer's Event Viewer.