FortiSOAR Administrator
Cybersecurity
COURSE OVERVIEW
In this course, you will learn about FortiSOAR architecture, and how to deploy, configure, manage, operate, and monitor FortiSOAR in a multi-tenant SOC environment. You will learn about various system customization options, high-availability (HA) deployment, security management using role-based access control (RBAC), and various system monitoring tools.
WHO SHOULD ATTEND
Cybersecurity professionals responsible for planning, deploying, configuring, and managing FortiSOAR deployments in a SOC environment should attend this course.
PREREQUISITES
It is recommended that you be familiar with SOC technologies and processes.
Duration: 2 Days / 16 Hours
Delivery Method: Classroom-based, Virtual Instructor Led Training
AGENDA
- Introduction to FortiSOAR
- System Configuration
- FortiSOAR Content Configuration
- User Administration
- Searching and Incident Response
- Multi-Tenancy
- High Availability
- System Monitoring and Troubleshooting
OBJECTIVES
After completing this course, you should be able to:
- Plan a FortiSOAR deployment
- Identify the role of SOAR in assisting security teams
- Describe incidents and alerts in a SOC environment
- Configure applications
- Manage audit logs
- Export and import a FortiSOAR modular configuration
- Perform a full database backup and restore
- Describe the different types of services in the FortiSOAR Content Hub
- Configure connectors for devices
- Configure connectors through agents
- Configure data ingestion from cybersecurity devices
- Configure data ingestion from external indicator of compromise (IOC) feeds
- Configure role-based access control (RBAC)
- Configure teams
- Configure roles and users
- Configure authentication
- Configure SLA templates
- Configure shift management queues
- Review Elasticsearch basics
- Review FortiSOAR recommendation engines
- Configure Elasticsearch based record similarity
- Configure machine learning (ML)
- Describe how to delegate incidents across different teams
- Configure war rooms
- Describe the different ways to configure FortiSOAR for multiple tenants
- Configure a multi-tenant architecture
- Configure the secure message exchange (SME) server
- Perform operations on a tenant FortiSOAR server
- Identify different high availability (HA) implementation prerequisites and configuration options
- Manage cluster licensing
- Configure HA with an internal or external PostgreSQL database
- Identify HA best practices
- Configure system monitoring and notifications
- Configure the system health check widget
- Configure different levels of logging
- Review FortiSOAR services and processes
SYSTEM REQUIREMENTS
If you take the online format of this class, you must use a computer that has the following:
- A high-speed Internet connection
- An up-to-date web browser
- A PDF viewer
- Speakers or headphones
- One of the following:
- HTML 5 support
- An up-to-date Java Runtime Environment (JRE) with Java Plugin enabled on your web browser
You should use a wired Ethernet connection, not a WiFi connection. Firewalls, including Windows Firewall or FortiClient, must allow connections to the online labs.
REGISTER NOW
