NSE6_FSR-7.3 Fortinet NSE 6 - FortiSOAR 7.3 Administrator Questions and Answers

When configuring the system proxy for FortiSOAR, it is essential to ensure connectivity to certain URLs to maintain system updates and licensing. For FortiSOAR, access to https://iepo.fortisoar.fortinet.com is required for incident enrichment and analysis, while https://globalupdate.fortinet.net is necessary for global updates to keep the system up-to-date with the latest threat information. These connections allow FortiSOAR to communicate with Fortinet's servers to fetch updated threat intelligence and system updates, which are critical for the operational effectiveness of FortiSOAR​.

In FortiSOAR, appliance users are accounts that represent non-human entities, such as system processes or integrations. These users do not require login IDs and therefore do not contribute to the licensing user count. Appliance users are configured for backend tasks or to interact with external systems, enabling automated processes without consuming standard user licenses. This approach optimizes system resources and keeps licensing costs manageable​.

In FortiSOAR, the "Application Administrator" role is a default role that holds broad privileges, including the ability to assign permissions to other teams. This role is fundamental to system administration and is recommended not to be removed as it provides crucial administrative capabilities. Removing or modifying this role could impact FortiSOAR's ability to manage user roles and permissions effectively, which could hinder system operations and user management​.

The FortiSOAR perpetual trial license includes limitations on both the number of users and the number of actions that can be performed. These restrictions are in place to provide prospective users with a functional evaluation of FortiSOAR while limiting its usage in a production environment. The trial license does not support multi-tenancy and restricts the overall capacity for scaling, making it suitable only for testing and familiarization with FortiSOAR’s capabilities​.

When joining a FortiSOAR cluster as a standby node, the correct status value should be passive. Using active would imply that the node is trying to join as an active node, which could cause conflicts in the cluster setup. In FortiSOAR, standby nodes must be set as passive to ensure they are recognized correctly and to avoid conflicts with the primary node or other active nodes within the cluster. Therefore, setting the status to passive will resolve the issue and allow the node to join the cluster as intended​.

When deleting a user account in FortiSOAR, the user ID must be entered into the usersToDelete.txt file. This file is specifically used to list users that are marked for deletion. Once the user IDs are listed in this file, the system can process the deletion of these accounts as part of its user management operations. This method ensures that only specified users are deleted, as referenced in FortiSOAR's administrative controls​.

In a FortiSOAR HA configuration, certain ports must be open for communication between nodes. Port 5432 is required for PostgreSQL database communication, which is essential for data replication between HA nodes. Port 9200 is used by Elasticsearch, which FortiSOAR leverages for indexing and search functions across the nodes. These ports must be accessible between nodes to ensure seamless operation and data consistency within the cluster​.

When importing modules into FortiSOAR using the configuration wizard and selecting "Merge with Existing" as the bulk action, the behavior for field handling is as follows: any fields that already exist in the system are overwritten with the imported values. New fields from the imported module are added to the system, while fields that are not part of the imported module remain unaffected and are retained in the system. This option ensures that existing data structures are updated with new information without losing existing, but non-imported, fields​.