I85PREP
⌘ K
Fortinet FCF study materials
Fortinet FCF study resources

Fortinet FCF: Security Operations Fundamentals

Fortinet FCF · Work through your exam, one topic at a time.

All guide sections

Security Operations Fundamentals

Security Operations Fundamentals covers how a security operations center (SOC) detects, investigates and responds to incidents, and which Fortinet products support each stage. Questions focus on the people-process-technology model, the incident response lifecycle, and the difference between monitoring, analytics and automation tooling.

Roles inside the SOC

  • Tier 1 performs triage: validate the alert, decide true or false positive, escalate.
  • Tier 2 investigates, scopes affected assets and drives containment.
  • Tier 3 handles threat hunting, malware analysis and forensics.
  • Supporting roles include detection engineering, SOC management and compliance reporting.

The technology stack

  • SIEM collects logs from firewalls, endpoints, identity systems and cloud, normalizes them into a common schema, correlates events with rules and raises alerts. FortiSIEM combines SIEM, UEBA and asset/CMDB context.
  • SOAR turns repeatable response steps into playbooks and cases, with connectors that call enforcement points. FortiSOAR is the Fortinet platform here.
  • EDR/XDR records endpoint behavior, detects suspicious process chains and can isolate a host or kill a process.
  • Sandboxing and threat intelligence detonate unknown files and supply indicators, with FortiSandbox and FortiGuard Labs feeds feeding detection content.
  • Log management underpins everything: FortiAnalyzer stores FortiGate logs, builds reports and runs event handlers.

The incident response lifecycle

NIST SP 800-61 orders the phases as Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned. Containment is usually split into short-term (isolate the host) and long-term (rebuild, patch, block indicators).

Worked example

A correlation rule fires because 40 users received mail from one lookalike domain. The SOAR playbook extracts the URLs, detonates them in the sandbox, queries EDR for any execution of the dropped binary, blocks the domain at the FortiGate, quarantines the messages and opens a case. The analyst confirms scope - how many actually clicked, whether credentials were entered - before declaring containment complete. Only then is the host reimaged and the case closed with lessons learned.

Traps that cost marks

  • Treating SIEM (visibility and correlation) and SOAR (orchestrated action) as the same product category.
  • Containing a single host before confirming scope, letting the attacker pivot.
  • Confusing MTTD (detection) with MTTR (recovery).
  • Automating destructive actions without an analyst approval gate.
  • Skipping lessons learned, so the same alert recurs unchanged.