Fortinet FortiSOAR Reviews

Fortinet FortiSOAR is a platform that allows you to orchestrate a lot of different solutions to automate response and follow all the incidents you are tracking between all your devices and the data collected.

The most valuable feature of Fortinet FortiSOAR is the number of available connectors and the simplicity to start to automate. You can use some playbooks that are already created on the platform.

Usually, FortiSOAR is used for some of our security operation tasks where it is necessary to ascertain the integrity of threat vectors and then take action against them. In addition, we automate other processes within our security operations procedure through FortiSOAR.

FortiSOAR is really effective, providing us with significant savings on operational costs by reducing the number of SOC analysts we need to employ. Thanks to its automation capabilities, operational cost is reduced.

Right now, I am building the playbook for SOC. So mainly, my used case is about trying to alleviate some of the workload from manual tasks to automated using playbook implementations on the portal side,

When it comes to automation, if I am sending an alert to the customer before sending an alert, I check if the IP authentication is done, and check with the other integrations, like the EDR or antivirus tools, and then send the email.

Generally, the tool helps just automating a lot of manual load or repetitive tasks. The tool allows me to have a lot of time to spend on other very important things in my company.

We use the solution for financial services. Usually, we recommend or resell the tool after the client has already purchased a network visibility solution. Fortinet FortiSOAR will help automate the process and minimize human errors.

Fortinet FortiSOAR is a very interactive and user-friendly solution. The tool makes everything clear, and users know where to look if they want anything. It has a very wide support in documentation and resources.

We are using FortiSOAR for case management. We also have Forti Fabric in our environment and have been using FortiGate firewalls for many years. 

The best compatibility for a SIEM solution that was recommended to us was Fortinet as it is highly compatible with our security devices, like FortiGate Firewalls. 

We use FortiSOAR to generate automated responses against cyber incidents in our cyberspace. We utilize various playbooks for actions like disabling network cards, user IDs, or computer accounts, triggering security policies over the firewall, or executing PowerShell scripts to protect our digital assets.

Keeping in view the compatibility with Fortinet products, we chose FortiSOAR for case management. It generates automated responses for cyber incidents.

The most valuable component of the solution is its playbook feature. The product allows for automation in case any incidents happen by allowing the policy to be pushed to Juniper, Cisco, Palo Alto, including any other router for firewall without any issues.

The UI design of the solution needs to be changed since it can get difficult for a newbie to operate. For experts, there is a need to polish the product's UI more intelligently. UI is not that good in all Fortinet products. The UI needs to be made more interactive and user-friendly. Came to know from the product's support team about some ongoing improvements being made in the product's UI.

The primary use case for our clients is deploying automatization component of FortiSOAR to help mitigate breaches or attacks without human error. The solution automates everything using the playbooks and pre-deployed response mitigation scenarios. Companies that can use this product may have an infrastructure team but may not be able to attract IT security talent. FortiSOAR helps them minimize human errors. I would say that this is most important and beautiful thing you can have in cybersecurity right now.

FortiSOAR's most valuable feature is its ability to correlate the products and vendors that do not have a native interconnection between them.

Fortinet provides automation capabilities for event detection and remediation. It also provides a centralized QE where all the events are consolidated and correlated and it gives you visibility to the entire workflow of a specific threat event. It provides some remediation for the particular threats or alerts based on its profile of criticality.

The most valuable feature is its centralization as you don't want to be going to different locations to correlate items or to piece anything together to derive meaningful insights. We want to have a centralized QE for analytics, visibility, assessments, and decision-making and this solution allows for that.

The other feature that I personally appreciate is its accessibility. You can integrate it with other systems within the environment such as ticketing systems or something for sending alerts and then creating tickets for the operations or security operations team. They can get alerted when these events happen so they can be aware of events and even start troubleshooting for the investigation if it is warranted. It can be integrated seamlessly with other internal systems.

The initial setup is straightforward.