Fortinet NSE7_SOC_AR-7.6 - Fortinet NSE 7 - Security Operations 7.6 Architect

Step 1: FortiSIEM event log

Step 2: FortiSIEM incident

Step 3: FortiSOAR alert

Step 4: FortiSOAR incident

Exact Extract: “FortiSIEM: Event: An event refers to a single log or data point collected from a monitored device. It’s the most basic unit of information received by FortiSIEM, such as a firewall log or a system alert.” The guide also states: “Incident: An incident in FortiSIEM is created when a correlation rule is triggered.”

Exact Extract: “This slide explains how to map fields between FortiSIEM incidents and FortiSOAR alerts during the ingestion process. Use the wizard to define how FortiSIEM data populates FortiSOAR alert fields.”

Exact Extract: “FortiSOAR ingests FortiSIEM incidents as alerts… If the alert is not a valid threat, then the analyst can close it as a false positive. Otherwise, the analyst can open an incident.”

The correct sequence is FortiSIEM event log → FortiSIEM incident → FortiSOAR alert → FortiSOAR incident. FortiSIEM first receives raw event logs from monitored devices. If those events match a correlation rule, FortiSIEM creates a FortiSIEM incident. The FortiSOAR default data ingestion wizard then ingests FortiSIEM incidents into FortiSOAR as alerts, not as FortiSOAR incidents directly. After triage and validation, the analyst or playbook can escalate the alert into a FortiSOAR incident.

Technical Deep Dive: FortiSIEM and FortiSOAR use different object models. FortiSIEM “incident” means a correlation result from event analytics. FortiSOAR “alert” is the first SOAR-side record created from that SIEM incident. FortiSOAR “incident” is a higher-level case-management container used after validation. This separation is intentional: not every SIEM incident deserves full incident-response handling. FortiGate NP/CP offloading is irrelevant because this workflow is log ingestion and case orchestration, not firewall packet acceleration.

Understanding FortiAnalyzer Features:

FortiAnalyzer includes several features for log analytics, monitoring, and incident response.

The SIEM (Security Information and Event Management) database is used to store and analyze log data, providing advanced analytics and insights.

Evaluating the Options:

Option A: Threat hunting

Threat hunting involves proactively searching through log data to detect and isolate threats that may not be captured by automated tools.

This feature leverages the SIEM database to perform advanced log analytics, correlate events, and identify potential security incidents.

Option B: Asset Identity Center

This feature focuses on asset and identity management rather than advanced log analytics.

Option C: Event monitor

While the event monitor provides real-time monitoring and alerting based on logs, it does not specifically utilize advanced log analytics in the way the SIEM database does for threat hunting.

Option D: Outbreak alerts

Outbreak alerts provide notifications about widespread security incidents but are not directly related to advanced log analytics using the SIEM database.

Conclusion:

The feature that uses the SIEM database for advanced log analytics and monitoring in FortiAnalyzer is Threat hunting.

Exact Extract: “Attribute: Event Type Operator: IN Value: EventTypes: Logon Failure.” The same section explains that when selecting a group from the CMDB, “the value displays Group: < Name > when you select the group from CMDB initially.”

The correct answer is B because FortiSIEM uses the IN operator when a search condition references a CMDB group or category. In this case, the value is Group: Logon Success, meaning the query is not matching one literal event type string; it is matching membership in a CMDB event type category. Therefore, the condition should be configured as Event Type IN Group: Logon Success. CONTAIN is for substring matching, such as checking whether a text field contains a word. IS or exact equality-style logic would be appropriate for a single specific value, not a CMDB group. HAS is not the correct operator for matching Event Type membership in a CMDB category.

Technical Deep Dive: In FortiSIEM analytics, CMDB-backed values are object groups, not simple strings. The IN operator tells FortiSIEM to expand the selected CMDB group and match any event type inside that category. This is cleaner than manually adding many Event Type OR conditions. For example, a “Logon Success” group can include multiple normalized success-login event types across Windows, VPN, Unix, and other sources. This is SIEM query logic only; NP/CP ASIC offloading does not apply because FortiSIEM is searching normalized event data, not processing FortiGate traffic flows.

Understanding Playbook Triggers:

Playbook triggers are the starting points for automated workflows within FortiAnalyzer or FortiSOAR.

These triggers determine how and when a playbook is executed and can pass relevant information (trigger variables) to subsequent tasks within the playbook.

Types of Playbook Triggers:

EVENT Trigger:

Initiates the playbook when a specific event occurs.

The event details can be used as variables in later tasks to customize the response.

Selected as it allows using event details as trigger variables.

INCIDENT Trigger:

Activates the playbook when an incident is created or updated.

The incident details are available as variables in subsequent tasks.

Selected as it enables the use of incident details as trigger variables.

ON SCHEDULE Trigger:

Executes the playbook at specified times or intervals.

Does not inherently use trigger events to pass variables to later tasks.

Not selected as it does not involve passing trigger event details.

ON DEMAND Trigger:

Runs the playbook manually or as required.

Does not automatically include trigger event details for use in later tasks.

Not selected as it does not use trigger events for variables.

Implementation Steps:

Step 1: Define the conditions for the EVENT or INCIDENT trigger in the playbook configuration.

Step 2: Use the details from the trigger event or incident in subsequent tasks to customize actions and responses.

Step 3: Test the playbook to ensure that the trigger variables are correctly passed and utilized.

Conclusion:

EVENT and INCIDENT triggers are specifically designed to initiate playbooks based on specific occurrences, allowing the use of trigger details in subsequent tasks.

Fortinet Documentation on Playbook Configuration FortiSOAR Playbook Guide

By using the EVENT and INCIDENT triggers, you can leverage trigger events in later tasks as variables, enabling more dynamic and responsive playbook actions.

The Pyramid of Pain (David Bianco) is a core concept taught in FortiSIEM 7.3 and FortiSOAR 7.6 curriculum to help SOC analysts prioritize threat intelligence and detection logic. The model ranks indicators based on the " pain " or effort they cause an adversary to change:

IP Addresses (Easy): These are classified as " Easy " to change. An attacker can simply rotate through a proxy service, use a different VPS, or utilize a new compromised host to continue their campaign. While more valuable than a file hash, they provide relatively low-long term value to the defender because they are so ephemeral.

TTPs (Tough/Hard): This is the apex of the pyramid. TTPs (Tactics, Techniques, and Procedures) represent the fundamental way an adversary operates. If a defender successfully detects and blocks a Tactic (e.g., a specific way an attacker performs privilege escalation), the adversary is forced to reinvent their entire operational process, which is time-consuming and difficult.

Why other options are incorrect:

Artifacts (C): According to the pyramid, Network/Host Artifacts are classified as " Annoying " , not " Easy " . While an attacker can change them, it requires modifying their code or script behavior, which causes more friction than simply switching an IP address.

Tools (D): Tools are classified as " Challenging " . While alternatives exist, an adversary usually invests significant time mastering a specific toolset; losing the ability to use that tool effectively disrupts their efficiency significantly.

Understanding the Requirements:

The objective is to create an incident and generate a report based on malicious attachment events detected by FortiAnalyzer from FortiSandbox analysis.

The endpoint hosts are protected by FortiClient EMS, which is integrated with FortiSandbox. All logs are sent to FortiAnalyzer.

Key Components:

FortiAnalyzer: Centralized logging and analysis for Fortinet devices.

FortiSandbox: Advanced threat protection system that analyzes suspicious files and URLs.

FortiClient EMS: Endpoint management system that integrates with FortiSandbox for endpoint protection.

Playbook Analysis:

The playbook in the exhibit consists of three main actions: GET_EVENTS, RUN_REPORT, and CREATE_INCIDENT.

EVENT_TRIGGER: Starts the playbook when an event occurs.

GET_EVENTS: Fetches relevant events.

RUN_REPORT: Generates a report based on the events.

CREATE_INCIDENT: Creates an incident in the incident management system.

Selecting the Correct Connector:

The correct connector should allow fetching events related to malicious attachments analyzed by FortiSandbox and facilitate integration with FortiAnalyzer.

Connector Options:

FortiSandbox Connector:

Directly integrates with FortiSandbox to fetch analysis results and events related to malicious attachments.

Best suited for getting detailed sandbox analysis results.

Selected as it is directly related to the requirement of handling FortiSandbox analysis events.

FortiClient EMS Connector:

Used for managing endpoint security and integrating with endpoint logs.

Not directly related to fetching sandbox analysis events.

Not selected as it is not directly related to the sandbox analysis events.

FortiMail Connector:

Used for email security and handling email-related logs and events.

Not applicable for sandbox analysis events.

Not selected as it does not relate to the sandbox analysis.

Local Connector:

Handles local events within FortiAnalyzer itself.

Might not be specific enough for fetching detailed sandbox analysis results.

Not selected as it may not provide the required integration with FortiSandbox.

Implementation Steps:

Step 1: Ensure FortiSandbox is configured to send analysis results to FortiAnalyzer.

Step 2: Use the FortiSandbox connector in the playbook to fetch events related to malicious attachments.

Step 3: Configure the GET_EVENTS action to use the FortiSandbox connector.

Step 4: Set up the RUN_REPORT and CREATE_INCIDENT actions based on the fetched events.

Fortinet Documentation on FortiSandbox Integration FortiSandbox Integration Guide

Fortinet Documentation on FortiAnalyzer Event Handling FortiAnalyzer Administration Guide

By using the FortiSandbox connector, the analyst can ensure that the playbook accurately fetches events based on FortiSandbox analysis and generates the required incident and report.

Exact Extract: “What are two characteristics of threat hunting? … It looks for undetected threats… It requires a hypothesis and investigation.”

Exact Extract: “By demonstrating competence in examining a simple threat hunting use case, you will be able to conduct threat hunting based on an easily verifiable hypothesis.”

The correct answer is C. This is a threat hunting scenario, not a normal alert-engineering scenario. You do not know the attacker identity, infrastructure, tools, or exact TTPs, so the first mature action is to form a hypothesis such as: “If a similar DDoS campaign is targeting us, we may observe abnormal inbound request volume, source diversity, protocol concentration, SYN/UDP/HTTP flood patterns, or service degradation against exposed assets.” That hypothesis then drives the FortiSIEM analytics search and evidence collection.

A is useful later, after the hunt identifies a reliable detection condition. B is too broad and operationally expensive as a first step. D is weak because no relevant threat intelligence has been received, and enriching every external IP is noisy and inefficient.

Technical Deep Dive: A good DDoS hunt should start with exposed services, normal traffic baselines, traffic volume anomalies, source ASN/country dispersion, destination service concentration, firewall deny/accept spikes, SYN-to-completion ratios, and web request rates. After confirming patterns, you tune FortiSIEM rules and FortiSOAR response playbooks. FortiGate NP/CP acceleration may affect packet-forwarding performance under flood conditions, but the hunting workflow itself is driven by SIEM telemetry and hypothesis-based analytics.

Slot 1: vars.artifacts

Slot 2: json_query

Slot 3: ( " data.results[?type== ' FileHash-MD5 ' ]

Slot 4: value

Exact Extract: “You can assign specific fields from your connector action output to their own variables and further manipulate the data using Jinja filters. This approach allows you to efficiently extract, clean, and prepare information for use in later steps of your automation.”

Exact Extract: The guide shows the same Jinja pattern:

{{ vars.steps.Advanced_Search_Query.data.events | json_query( ' [].attributes.srcIpAddr ' ) | unique }}

and explains that similar Jinja logic applies to extracting other variables from structured output.

The correct expression is {{ vars.artifacts | json_query( " data.results[?type== ' FileHash-MD5 ' ].value " ) }} because the JSON object stores artifact records under vars.artifacts.data.results. Each object in results has a type and a value. The filter condition [?type== ' FileHash-MD5 ' ] selects only records whose type is FileHash-MD5, and .value returns only the MD5 hash strings, not the full objects.

tojson is unnecessary because the data is already structured and queryable. results, data, and value alone are incomplete because they do not filter by artifact type. The key operation is json_query, which uses a JMESPath-style expression to filter a list and project only the required field.

Technical Deep Dive: This is a classic FortiSOAR playbook parsing pattern. Use json_query when the object is already JSON-like and you know the path. The expression returns a list such as:

[ " 6aad63bcc3dd4e148f3724808955f912 " , " 9fd2b1c0e4a37658bca9d0f1e2c34567 " ]

This is automation-layer data extraction. FortiGate NP/CP offloading is irrelevant because no packet inspection or firewall data-plane forwarding is involved.