FortiSOAR

What differentiates FortiSOAR from other similar products?

The interesting thing about this tool is that it automates many steps in security incident response procedures. The necessity to focus only on threats and exclude repetitive task made my security team work more effectively using FortiSOAR – threat response time is significantly less.

What is your favorite aspect of this product?

In my opinion, the best thing about FortiSOAR is navigation and work on it since they used simple and more comprehensible interface. Even for those who have no significant knowledge about cybersecurity, this instrument is going to be easy to use. In addition, those in Fortinet enjoy warm technical support, they are always willing to support you if there are any issues or questions that you may wish to ask.

What do you dislike most about this product?

In what I least prefer about FortiSOAR its installation is slightly complicated at the starting point other than that running the software is a cakewalk.

What recommendations would you give to someone considering this product?

In conclusion, I would like to see FortiSOAR adopted by any organization that seeks to get the best out of its security team and at the same time work towards enhancing the organizations cyber security posture. It is my sincere hope that this software assisted me as much as I am absolutely confident it will assist you too.

What differentiates FortiSOAR from other similar products?

Great integration and still improving day by day.

What is your favorite aspect of this product?

The fact that the playbook designer is focused on the "no-code" philosophy; this way there is a lot less probability that there are errors encountered when the playbook is ran. The war room feature might be a game-changer in case of an IR, really nice way to concentrate everything in one spot.

What do you dislike most about this product?

The "no-code" logic, is a pro but it can also be a con. Maybe FortiSOAR is too focused on this aspect and leaving behind scripting with python for further customization. Don't get me wrong, there is a scripting section, however it should not be left behind. Something that might bring confusion to someone approaching to fortiSOAR for the first time is the data collected from the FortiSIEM: on the fortisiem an "offense" is called "incident" while when pushed on FortiSOAR it becomes an "Alert" which then can be escalated to an "Incident". In my humble opinion the naming convention should be reviewed.

What recommendations would you give to someone considering this product?

It's a great product, and it's quickly improving. So if your company is considering purchasing a SOAR this might suit your needs.

What differentiates FortiSOAR from other similar products?

FortiSOAR automates manual security tasks like alert triage, incident enrichment and response workflows. It has pre-built playbooks like ready to use automated workflows for security situations like phishing, malware etc. It makes work for analysts easy by keeping all evidence, action and decisions in one place.

What is your favorite aspect of this product?

FortiSOAR speeds up response, reduces repetitive work, and improves consistency of handling threats. Automated playbooks reduce repetitive tasks and analyst fatigue. Central case management helps teams track progress and evidence.

What do you dislike most about this product?

Playbook customisation is time consuming. Complex learning curve. Complex UI.

What recommendations would you give to someone considering this product?

FortiSOAR is especially useful for mid-to-large security teams or MSSPs wanting to automate SOC processes. It would be a great choice if your security operations team faces high alert volumes, repetitive investigation tasks, or needs to standardise incident response.