I85PREP
⌘ K
Fortinet NSE 6 study materials
Fortinet NSE 6 study resources

Fortinet NSE 6: Security Operations

Fortinet NSE 6 · Work through your exam, one topic at a time.

All guide sections

Security Operations

NSE 6 Security Operations covers monitoring and response with FortiAnalyzer, FortiManager and FortiGate automation: log collection, ADOMs, event handlers, reports and Security Fabric integration. The exam tests whether you can turn raw logs into a repeatable operational workflow.

Core rules

  • FortiAnalyzer organizes logs by ADOM. An ADOM is both an administrative and a logging boundary; choose its mode at creation because Backup mode stores FortiGate configuration revisions and Normal mode does not.
  • A FortiGate sends logs only if logging is enabled on the policy and a log destination is configured. Local disk logging and FortiAnalyzer forwarding are separate settings.
  • Event handlers are log-based triggers: a filter selects log fields, a frequency or threshold defines the condition, and notification actions such as email or syslog fire when it matches.
  • FortiGate automation stitches combine a trigger with actions, such as running a CLI script, sending a webhook or quarantining a host.
  • Reports use datasets and charts; scheduled reports depend on the ADOM having the expected log types and time range.

Worked example

You must alert the SOC when an administrator login fails repeatedly on a FortiGate. On FortiAnalyzer, create an event handler with a filter matching the admin login failure log description and the target administrator account. Set the condition to five matching logs in ten minutes and the action to email the SOC alias plus syslog to the SIEM. Reasoning: the event handler evaluates fields present in logs that actually reach FortiAnalyzer, so confirm the FortiGate forwards system-event logs in real time. Align time zones between FortiGate and FortiAnalyzer, otherwise a ten-minute window may include or exclude the wrong events.

Traps

Creating the event handler but leaving FortiGate policy logging off, so no logs arrive. Forgetting that the FortiGate local log store and FortiAnalyzer contain different retention sets. Using an ADOM mode that does not match the required configuration-revision workflow. Setting a threshold so high that brute-force attempts never trigger. Building scheduled reports without verifying that the ADOM receives the required log type.