NSE6_FSR-7.3 Fortinet NSE 6 - FortiSOAR 7.3 Administrator Questions and Answers

In FortiSOAR, SLA (Service Level Agreement) templates can be created for specific modules, including Alerts and Indicators. These templates are essential for tracking response and resolution times, ensuring compliance with defined service levels. By configuring SLAs on the Alerts and Indicators modules, organizations can monitor the time taken to address these items, which is critical in maintaining efficient incident response and management practices. The SLA templates can be customized according to specific business requirements and are applied to records within these modules to enforce timely actions​.

In a FortiSOAR HA configuration, certain ports must be open for communication between nodes. Port 5432 is required for PostgreSQL database communication, which is essential for data replication between HA nodes. Port 9200 is used by Elasticsearch, which FortiSOAR leverages for indexing and search functions across the nodes. These ports must be accessible between nodes to ensure seamless operation and data consistency within the cluster​.

When configuring the system proxy for FortiSOAR, it is essential to ensure connectivity to certain URLs to maintain system updates and licensing. For FortiSOAR, access to https://iepo.fortisoar.fortinet.com is required for incident enrichment and analysis, while https://globalupdate.fortinet.net is necessary for global updates to keep the system up-to-date with the latest threat information. These connections allow FortiSOAR to communicate with Fortinet's servers to fetch updated threat intelligence and system updates, which are critical for the operational effectiveness of FortiSOAR​.

Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:

The FortiSOAR Incidence Response Content Pack (which is essentially the predecessor or foundational component of the SOAR Framework Solution Pack in version 7.3) is designed to provide users with an immediate, functional environment. According to the FortiSOAR 7.3 Administration Guide and Content Hub documentation:

Sample Alerts and Incidents (C): The content pack includes a set of demo records. 3 Upon installation and clicking the "Demo IR Records" button, the system populates the Alerts and Incidents modules with pre-configured samples, including associated indicators and assets, to demonstrate how records are handled. 4

System Playbooks (D): It installs a comprehensive collection of "out-of-the-box" (OOB) playbooks. These include system-level playbooks used for triaging, indicator extraction, and managing standard record lifecycles (such as auto-populating dates when a record is closed). 5

Sample Data for Playbooks (B): Along with the records themselves, the pack includes simulation and training data (often referred to as "Playbook Samples" or "Mock Data"). 6 This allows administrators to test playbook logic and workflows without requiring live feeds from third-party security tools.

Why other options are incorrect:

System monitoring connectors (A): While the pack may configure some basic internal connectors (like the Code Snippet connector), "system monitoring connectors" are generally standalone integrations or part of specific device solution packs rather than the core IR pack.

SLA template module (E): Although the pack includes playbooks that manage SLAs (calculating response and resolution times), the "SLA Management" or "SLA Template" capability is often categorized as an additional module or handled via the Module Editor, rather than being a specific "feature" installed solely by the IR pack.

When troubleshooting the issue of the FortiSOAR GUI not being reachable, the first step should be to check the status of the nginx service, which is responsible for managing web requests. Using the command systemctl status nginx will provide information on whether the service is running and any potential issues or errors related to it. This approach is more efficient as it directly addresses the service responsible for the web interface, making it possible to diagnose and resolve common issues such as service failure, configuration errors, or connectivity problems​.

In FortiSOAR, system-level logs that can be purged include both "Audit logs" and "Executed Playbook logs." These types of logs can be configured to be purged periodically to free up storage space and ensure that unnecessary logs do not impact system performance. The application configuration allows administrators to schedule automatic purges, which can be especially useful in high-activity environments where log data accumulates quickly. Purging these logs helps maintain a cleaner and more efficient system​.

In FortiSOAR's War Room, users can perform several actions to manage incidents effectively. They can view a graphical representation of records linked to an incident in the Artifacts lab, which helps visualize connections and dependencies. Additionally, the War Room supports tagging investigation results as evidence, allowing for a structured approach to incident documentation. Users can also manage tasks via the Task Manager tab, facilitating task creation, assignment, and tracking within the incident response workflow​.