I85PREP
⌘ K
Fortinet FCX study materials
Fortinet FCX study resources

Fortinet FCX: Security Operations (SOC, SIEM, SOAR, EDR, NDR)

Fortinet FCX · Work through your exam, one topic at a time.

All guide sections

Security Operations (SOC, SIEM, SOAR, EDR, NDR)

Security Operations covers the detection-to-response chain: FortiAnalyzer for logging and event handlers, FortiSIEM for correlation, FortiEDR and FortiNDR for endpoint and network detection, FortiSandbox for verdicts, FortiDeceptor for lures and FortiSOAR for orchestration. The exam tests whether you know which platform owns which step, because a chain with one broken link produces alerts nobody acts on.

Telemetry and detection

  • FortiAnalyzer organises logs into ADOMs by device and firmware version. Event handlers watch log fields and trigger actions such as email, syslog, webhook or a SOAR playbook.
  • FortiSIEM discovers assets into a CMDB, collects events and applies rules; large deployments split supervisor and worker roles.
  • FortiSandbox returns a rating from static, dynamic and reputation checks; verdicts flow to FortiGate through the Fabric connector for inline blocking.

Endpoint and network response

  • FortiEDR collectors report to a core. Security policies run in simulation or protect mode - simulation detects and logs without blocking, a favourite exam trap. Classification and threat hunting drive investigation, and the FortiEDR connector lets the FortiGate quarantine the host at the edge.
  • FortiNDR analyses network traffic, extracts files, tracks lateral movement, keeps PCAP for replay and can trigger FortiGate response.
  • FortiDeceptor lures generate high-fidelity alerts because nothing legitimate should touch them.

SOAR

  • FortiSOAR ingests incidents from FortiAnalyzer, FortiSIEM, FortiEDR and third parties through connectors; playbooks add enrichment, approvals and containment actions, governed by RBAC.

Worked example

A workstation shows ransomware behaviour. FortiEDR detects it, but the policy is in simulation, so nothing is blocked. Corrected design: FortiEDR forwards the event, a FortiAnalyzer event handler matches the log field and calls a FortiSOAR playbook, the playbook requests analyst approval, then isolates the endpoint through the FortiEDR connector and blocks its IP on the FortiGate. Each link must be tested: handler enabled, connector authorised, playbook active.

Traps that cost marks

Simulation mode mistaken for protection; an event handler left disabled or throttled by log rate; ADOM mismatch so logs never reach the handler; a playbook referencing an untested connector; confusing a FortiGate automation stitch with a FortiAnalyzer event handler; setting a FortiSandbox rating threshold below the action you intended.