Course Overview
In this course, you will learn about FortiSOAR architecture, and how to deploy, configure, manage, operate, and monitor FortiSOAR in a multi-tenant SOC environment. You will learn about various system customization options, high-availability (HA) deployment, security management using role-based access control (RBAC), and various system monitoring tools.
This course is not part of a certification track.
Who should attend
Cybersecurity professionals responsible for planning, deploying, configuring, and managing FortiSOAR deployments in a SOC environment should attend this course.
Prerequisites
It is recommended that you be familiar with SOC technologies and processes.
Course Objectives
After completing this course, you should be able to:
- Plan a FortiSOAR deployment
- Identify the role of SOAR in assisting security teams
- Describe incidents and alerts in a SOC environment
- Configure applications
- Manage audit logs
- Export and import a FortiSOAR modular configuration
- Perform a full database backup and restore
- Describe the different types of services in the FortiSOAR Content Hub
- Configure connectors for devices
- Configure connectors through agents
- Configure data ingestion from cybersecurity devices
- Configure data ingestion from external indicator of compromise (IOC) feeds
- Configure role-based access control (RBAC)
- Configure teams
- Configure roles and users
- Configure authentication
- Configure SLA templates
- Configure shift management queues
- Review Elasticsearch basics
- Review FortiSOAR recommendation engines
- Configure Elasticsearch based record similarity
- Configure machine learning (ML)
- Describe how to delegate incidents across different teams
- Configure war rooms
- Describe the different ways to configure FortiSOAR for multiple tenants
- Configure a multi-tenant architecture
- Configure the secure message exchange (SME) server
- Perform operations on a tenant FortiSOAR server
- Identify different high availability (HA) implementation prerequisites and configuration options
- Manage cluster licensing
- Configure HA with an internal or external PostgreSQL database
- Identify HA best practices
- Configure system monitoring and notifications
- Configure the system health check widget
- Configure different levels of logging
- Review FortiSOAR services and processes
Outline: FortiSOAR Administrator (FORT-SOARADMIN)
- Introduction to FortiSOAR
- System Configuration
- FortiSOAR Content Configuration
- User Administration
- Searching and Incident Response
- Multi-Tenancy
- High Availability
- System Monitoring and Troubleshooting