Fortinet FCSS SOC cheat sheet

SOC tiers: Tier 1 triage/alert validation, Tier 2 deep investigation, Tier 3 threat hunting and detection engineering; escalation is based on severity and confidence.

FortiAnalyzer log retention defaults: 7 days for analytics, configurable up to 365 days; FortiSIEM uses per-rule retention and event archival to cold storage.

FortiSOAR playbook execution order: trigger (event/incident) → task graph → connector actions → approval gates; failed tasks follow the on-error path, not the success path.

Incident severity mapping in FortiSOAR: Critical = active data exfiltration or ransomware; High = confirmed compromise without spread; Medium = suspicious but unconfirmed; Low = policy violation.

IOC enrichment order: hash reputation → IP/domain reputation → WHOIS/ASN → sandbox detonation; stop enrichment when confidence exceeds the playbook threshold.

MITRE ATT&CK tactic order for triage: Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → C2 → Exfiltration → Impact.

FortiSIEM rule syntax: filter clause selects events, aggregation groups them, and the rule fires when the count exceeds the threshold within the time window.

MTTD/MTTR formulas: MTTD = sum(detection time − event time)/number of incidents; MTTR = sum(containment time − detection time)/number of incidents.

FortiGuard IOC service feeds: antivirus, IPS, web filter, DNS filter, and outbreak alerts; each has an independent update interval and must be licensed separately.

FortiGate policy evaluation is top-down, first-match; implicit deny follows all policies, and NAT is applied after security policy match.

FortiOS inspection modes: flow-based (default, ASIC-accelerated, no full file buffering) vs proxy-based (full content inspection, required for some DLP and antivirus features).

FortiGate HA: FGCP active-passive uses virtual MACs and heartbeat on all HA interfaces; failover triggers on link failure, heartbeat loss, or monitored interface failure.

SD-WAN rule selection order: SLA health check → priority → weighted load balance; a rule without an SLA target uses only priority and weight.

IPsec phase 1 vs phase 2: phase 1 negotiates IKE SA (authentication, DH group, lifetime); phase 2 negotiates IPsec SA (ESP, PFS, proxy IDs, lifetime).

FortiManager ADOM modes: normal (shared objects), backup (config only), and FortiGuard (central update service); device-level changes in backup mode do not sync to policy packages.

SSL inspection: certificate inspection reads SNI/CN only; deep inspection re-signs traffic with the FortiGate CA and requires the CA be trusted on endpoints.

FortiGate session table: sessions are offloaded to NP when possible; offloaded sessions bypass some UTM features unless the feature forces proxy or flow inspection.

SASE = SD-WAN + SSE; SSE components are SWG, CASB, ZTNA, and FWaaS; Fortinet delivers these through FortiSASE and FortiGate SD-WAN integration.

ZTNA access rule order: application → identity provider group → device posture check → action (allow/deny); posture failure denies before identity is evaluated only when configured as a precondition.

FortiSASE deployment modes: cloud-native (FortiSASE-hosted PoP), hybrid (FortiGate as on-ramp), and agent-based (FortiClient on endpoint); mode determines where policy is enforced.

SWG policy order in FortiSASE: explicit proxy rules → SSL inspection → web filter → application control → DLP; first match wins per category.

CASB inline vs API: inline inspects traffic in real time and can block; API mode scans sanctioned SaaS for data-at-rest violations and cannot block in real time.

ZTNA vs VPN: ZTNA grants per-application access with continuous posture checks; VPN grants network-level access after a single authentication.

FortiSASE licensing is per-user bandwidth-tiered; PoP selection is based on the user's nearest region and affects latency, not policy.

Device posture signals in FortiSASE: OS version, antivirus status, disk encryption, and FortiClient registration; each signal is evaluated independently.

FortiGate-VM licensing: BYOL (bring your own license, requires FortiFlex or permanent license) vs on-demand (pay-as-you-go via cloud marketplace); BYOL supports more VDOMs.

FortiCNP (Cloud Native Protection) uses read-only cloud roles for posture assessment and agentless workload scanning; it does not enforce inline traffic.

Cloud security group vs FortiGate policy: security groups are stateful at the hypervisor layer and are evaluated before traffic reaches the FortiGate-VM.

FortiCASB API permissions: read-only by default; write permissions are required for remediation actions such as quarantining a user or revoking a share.

Terraform provider for FortiOS: resource fortios_firewall_policy creates a policy; dependencies on address objects must be declared explicitly or apply fails.

Cloud WAF vs FortiWeb: cloud-native WAF is managed by the provider; FortiWeb-VM provides Fortinet signatures and must be deployed in the traffic path.

FortiCWP (Cloud Workload Protection) scans for misconfigurations, vulnerabilities, and malware in container images; findings map to CIS benchmarks.

Shared responsibility: provider secures physical/hypervisor; customer secures identity, data, and configuration; Fortinet tools cover the customer side only.

Purdue model levels: 0 physical process, 1 controllers, 2 supervisory, 3 operations, 3.5 DMZ, 4 enterprise, 5 internet; FortiGate commonly sits at the 3.5 DMZ.

OT protocol awareness: Modbus/TCP port 502, DNP3 port 20000, EtherNet/IP port 44818, OPC UA port 4840; FortiGate IPS signatures cover these but deep inspection is limited.

FortiGate in OT: use one-arm sniffer or TAP mode for passive visibility when inline blocking risks process disruption; inline mode requires validated signatures.

IEC 62443 zones and conduits: zones group assets by security level, conduits are the controlled paths between zones; FortiGate policies implement conduits.

OT change windows: patching is scheduled during maintenance shutdowns; compensating controls (segmentation, IPS virtual patching) are used between windows.

FortiSwitch/AP in OT: industrial-rated FortiSwitch models support extended temperature; standard models are not rated for plant-floor environments.

Safety instrumented systems (SIS) must remain isolated from the control network; FortiGate policy should deny SIS-to-IT traffic except through a dedicated conduit.