NSE6-FSR-7-3: Fortinet NSE 6 - FortiSOAR 7.3 Administrator

In FortiSOAR, cyops-search/falcon.log is used to troubleshoot Search and Elasticsearch issues, including checking the status of Elasticsearch indexing.

Elasticsearch is designed to store, search, and analyze large volumes of data with near-real-time indexing and fast query responses. FortiSOAR uses an Elasticsearch database to support global searching across its records. FortiSOAR configuration documentation specifies db_config.yml for a remote Elasticsearch location and requires an external Elasticsearch cluster version of at least 7.0.2.

FortiSOAR requires the IdP user attributes firstname, lastname, and email to be mapped for SAML authentication.

pg_hba.conf defines PostgreSQL client authentication and the permitted FortiSOAR host or subnet entries. postgresql.conf must permit remote connections, such as by setting listen_addresses, so the external database can receive those connections.

FortiSOAR Queue and Shift Management supports shift handovers, shift rosters with shift leads and team members, and automated queue assignment based on defined matching conditions or custom filters. The feature documentation specifically describes managing shift handovers and creating shift rosters with shift leads and team members.