NSE7-SOC-AR-7-6: Fortinet NSE 7 - Security Operations 7.6 ArchitectDemo

Threat hunting is a proactive investigative practice that starts with a testable hypothesis, analyzes available evidence such as network packets, and uses threat-intelligence enrichment to add context to records and indicators. Correlation-rule tuning is detection engineering, and workflow automation is security orchestration.

Records created or updated through the Ingest Bulk Feed step do not trigger playbooks that use the On Create or On Update trigger. The step is designed for high-volume ingestion and is significantly faster than the Create Record step.

Tactics, techniques, and procedures are difficult for adversaries to change because they must adapt their underlying methods of operation. IP addresses are comparatively easy to change because adversaries can shift infrastructure or use alternative addresses.

Each FortiSIEM subpattern is independently defined with its own group-by attributes and aggregate conditions (thresholds). Using OR makes the rule trigger when either subpattern meets its own criteria, allowing the two event types to be grouped and thresholded differently. Notification policies and the rule time window are rule-level settings rather than separate per-subpattern benefits.

An HTTP 401 response confirms that FortiSOAR reached FortiSIEM but that FortiSIEM rejected the authentication request. The configured username and password must match a valid FortiSIEM account, and the organization must match that account’s authentication scope. For Enterprise deployments, Fortinet specifies super as the organization; using FortiSIEM instead can cause the request to be unauthorized.

Credential Access covers stealing account names and passwords, as occurred when the counterfeit login page collected employee credentials. Initial Access covers gaining an initial foothold; abusing stolen valid credentials to authenticate to an externally available VPN portal constitutes Initial Access.

FortiSOAR displays linked records in the Visual Correlation widget only after the relevant modules and their relationships are configured in Correlation Settings. Add the custom Tickets module as a related module for Incidents so its existing linked ticket records can appear in the correlation graph.

A Manual Trigger permits on-demand execution with operator-supplied input. The connector action uses that IP-range input to return devices, and a Create Record step can create the corresponding asset records from the returned device IP-address data. No record update, intermediate variable, or code transformation is necessary for this workflow. FortiSOAR documents Manual Trigger as an on-demand playbook trigger and Create Record as a core step for creating records.

FortiSIEM uses the IN operator when an event attribute is matched against a CMDB group. An Event Type in the Logon Success group is therefore evaluated as membership in that event-type category, not as a literal or substring comparison.

This FortiSIEM rule is meant to detect failed logins followed by a successful login (brute-force success). The subpattern relationships only correlate FailedLogin with FailedLogin2 (Reporting IP, Source IP, User); SuccessLogin is not bound to any FailedLogin/FailedLogin2 attribute, so the rule would fire on any successful login regardless of whether it came from the same source/user as the failures (D). The SuccessLogin subpattern is also missing the logical operator needed to evaluate it against those relationships (the relationship block ends on a dangling operator with no SuccessLogin correlation), so the attacker-to-victim binding is never enforced (C). Lowering the 900-second window (A) is not the defect, and the FailedLogin/FailedLogin2 relationships (B) are correct and must not be removed.

Macrosegmentation divides the user departments and server functions into separate security zones, allowing only explicitly authorized traffic between zones. This reduces the reachable attack surface and constrains lateral movement if a device or service is compromised. Fortinet identifies network segmentation as an attack-surface-reduction measure because distinct segments can be controlled with inter-segment policies.

A FortiSIEM nested search combines an inner query whose results feed a filter value in the outer query. Here the event condition (which devices generated Windows Login Failure events) is expressed as the Inner Event Query, producing a list of device identifiers. The outer query is a CMDB query (Outer CMDB Query) that selects devices discovered by a FortiSIEM Windows Agent and uses the inner query's device list (via IN/Select from Report) as its filter. The data type of the outer query's filter attribute must match a display column in the inner query, so the correct pair is Outer CMDB Query and Inner Event Query.

Protocol tunneling encapsulates or forwards traffic within another protocol to bypass network filtering or reach systems that would otherwise be inaccessible. SSH port forwarding can carry HTTPS traffic through an SSH tunnel via the engineering build server.

FortiSOAR lets users select only the returned output keys they want to save from a direct connector action. Those selected keys are saved as an action log in the Workspace, reducing the amount of action-output data retained while preserving the relevant results for team review.

NIST SP 800-61 Revision 2 includes Preparation and Detection and Analysis as incident-response phases. FortiSOAR separates confirmation of an incident and identification as distinct handling phases; neither is a named phase in the NIST Revision 2 lifecycle.

FortiGate REST API access requires HTTPS to be enabled on the target interface; the FortiSOAR connector uses HTTPS, normally on port 443. A REST API administrator with Trusted Hosts configured accepts access only from the listed source addresses or subnets, so 10.200.200.160 must be added. The administrator profile needs only the least privileges required by the intended actions, not necessarily System read/write permissions.

Record uniqueness conditions define which field or combination of fields identifies a duplicate, preventing creation of a matching record. For a Create Record step encountering that uniqueness conflict, the Do Not Create a New Record (Keep the Existing Intact) behavior skips creation and leaves the existing record unchanged while continuing to work with it; stopping the create process would instead halt execution.

A module appears as an option for automatic assignment while creating or configuring queues only when its Queueable setting is enabled. If the Tasks module is absent from the Module Types list, that setting is disabled for the module.

In FortiSOAR, applying the Evidence tag to an action result marks that result as evidence and adds it to the Evidences tab. This designates the action log as evidence rather than placing it in the manually uploaded-evidence area.

FortiSOAR requires Enable Shift-Based Assignment to limit round-robin alert assignments to queue members who are currently on shift. Without it, round-robin assignment uses the queue’s members regardless of shift status. Alerts are queueable by default.

Threat hunting is guided by a hypothesis based on known malicious behavior. Reviewing the adversary’s tactics, techniques, and procedures (TTPs) establishes the behaviors to look for and enables targeted searches of the appropriate telemetry. MITRE ATT&CK documents adversary behavior through TTPs, while Microsoft Sentinel describes proactive hunting as being based on MITRE techniques, recent threats, or a custom hypothesis.