Automate the response. Accelerate the containment. Reduce the noise.
Fortisoar Administration Training
Develop the Security Orchestration, Automation, and Response platform administration, playbook development, and SOC automation skills that modern security operations centers genuinely require.
- UK Licensed
- Global Standards
- Expert Instructor
- 5 Day Training
- Overview
Course Overview
Security operations teams aren’t losing the fight against threats because they lack visibility. They’re losing it because the volume of alerts, the manual investigation steps, and the tool-switching overhead between security platforms makes it impossible to respond at the speed threats actually move. Security Orchestration, Automation, and Response platforms exist to close that gap by automating the repetitive investigation and response actions that consume analyst time, so human judgment gets applied where it actually matters rather than across every tier-one alert that fires.
This security orchestration automation and response training program covers FortiSOAR platform administration, automated playbook development, and incident response automation across realistic SOC scenarios using the same platform that enterprise security operations teams run in production. This course prepares participants for the Fortinet NSE 6 – FortiSOAR Administrator certification exam.
It sits within our certificate programs portfolio alongside deep learning courses and other top certificate programs, bringing the same technically rigorous, hands-on approach to security platform administration that we apply across our cybersecurity programs.
- Goals
Course Objectives
By the end of this program, attendees will be able to:
- Administer and configure the FortiSOAR platform across user management, role-based access control, and system configuration
- Build automated playbooks that orchestrate multi-step incident response automation workflows across integrated security tools
- Integrate FortiSOAR with SIEM, EDR, threat intelligence, and ticketing platforms using the connector framework
- Design SOC automation workflows that reduce alert fatigue by automating tier-one investigation and triage decisions
- Manage cases, incidents, and alerts within FortiSOAR across the full security operations center framework lifecycle
- Prepare confidently for the Fortinet NSE 6 – FortiSOAR Administrator certification examination
- Key Points
Who Should Attend?
- SOC Analysts and Team Leads Building Automation Capability
- Security Engineers Administering SOAR Platform Deployments
- Incident Response Teams Implementing Response Automation
- Security Architects Designing Security Orchestration Platform Integration
- IT Managers Overseeing Security Operations Center Automation Programs
- Organizations Building SOC Automation Capability Across Security Operations
- Key Benefits
Key Benefits of the Course
- A security orchestration automation and response program grounded in real SOC automation and incident response scenarios
- Practical FortiSOAR playbook development and incident response automation skills applicable from the next SOC workflow design assignment
- Stronger SOAR platform administration capability covering integration, case management, and automation workflow design
- Clear security orchestration platform methodology for reducing alert fatigue and accelerating threat containment
- A recognized credential from our top certificate programs portfolio supporting progression toward senior security operations and SOAR platform administration roles
- Outline
Course Outline
Day 1: FortiSOAR Platform Architecture and Administration Fundamentals
- Covers FortiSOAR platform architecture: how the Security Orchestration, Automation, and Response platform is structured, how its core components connect, and what the administration role involves across user management, role-based access control, and system configuration in enterprise SOC environments
- Introduces FortiSOAR interface navigation, tenant configuration, and the platform setup decisions that determine whether a SOAR deployment becomes the operational backbone of a security operations center or an underutilized tool that analysts work around
- Real SOC automation examples show where FortiSOAR deployments that were technically configured but operationally misaligned with analyst workflows failed to deliver the alert fatigue reduction and response time improvement that security orchestration platform deployments are supposed to produce
Day 2: Connector Integration and Security Tool Orchestration
- Covers FortiSOAR connector framework administration, how to integrate SIEM platforms, EDR solutions, threat intelligence feeds, ticketing systems, and firewall management tools into a coordinated security orchestration platform that shares data and triggers actions across the full security toolstack
- Introduces connector configuration, API integration methodology, and the data mapping discipline that ensures information flowing between integrated security tools arrives in the format that automated playbooks and analyst dashboards can actually use
- Attendees complete a realistic connector integration exercise covering SIEM and threat intelligence platform connectivity, developing the integration administration skills that multi-tool SOC automation deployments consistently require
Day 3: Automated Playbook Development and Incident Response Automation
- Covers FortiSOAR playbook design and development: how to build automated workflows that execute multi-step incident response automation sequences across integrated security tools without requiring analyst intervention at each stage
- Introduces playbook logic design across conditional branching, loop structures, approval gates, and the human-in-the-loop decision points that keep automation operating within appropriate boundaries without eliminating the analyst judgment that complex incidents require
- Hands-on exercises develop playbook development skills across realistic SOC automation scenarios phishing triage, malware alert investigation, and credential compromise response building the automation design competency that reduces analyst tier-one workload without creating automation that operates outside safe boundaries
Day 4: Case Management, Alert Triage, and SOC Automation Operations
- Covers FortiSOAR case management across alert ingestion, case creation, investigation tracking, and the escalation and closure workflows that keep a security operations center framework operating with visibility and accountability across every active incident
- Introduces alert triage automation: how to configure FortiSOAR to automatically enrich, score, and route incoming alerts based on severity, source, and context, so analyst attention is directed toward the alerts that genuinely require human investigation rather than distributed equally across everything that fires
- Attendees design and implement a realistic SOC automation alert triage and case management workflow, developing the operational configuration skills that production FortiSOAR deployments require to deliver meaningful workload reduction
Day 5: Advanced Administration, Reporting, and NSE 6 Exam Preparation
- Covers advanced FortiSOAR administration topics including performance monitoring, system health management, backup and recovery, and the platform governance disciplines that keep a production SOAR cybersecurity deployment reliable and auditable over time
- Introduces FortiSOAR reporting and dashboard configuration how to build the operational visibility that SOC leadership needs to evaluate automation effectiveness, analyst workload, and incident response performance across the security operations center
- Attendees complete a timed Fortinet NSE 6 FortiSOAR Administrator practice examination with structured feedback on domain coverage gaps and the question types most commonly encountered in the certification assessment
- Terms
Training Methodology
This program combines:
- FortiSOAR administration and playbook development workshops using realistic SOC automation scenarios and live platform environments
- Connector integration and incident response automation exercises with structured peer review and instructor feedback
- Case management and alert triage sessions built around real security operations center automation challenges
- Fortinet NSE 6 FortiSOAR Administrator certification examination preparation aligned to current exam domain objectives
- Achievements
Certification
Attendees receive a certificate of completion issued by GII Corporate & Industrial Training Center upon successful completion of the program. This course prepares participants for the Fortinet NSE 6 – FortiSOAR Administrator certification exam, which Fortinet administers and awards separately upon passing the examination. In-house training is available for security operations teams implementing or expanding FortiSOAR deployments. Contact us for upcoming dates across our training portfolio.
- Case Study
Case Study Example
A financial services organization had deployed FortiSOAR twelve months earlier with the goal of reducing analyst alert fatigue across its SOC. Twelve months later, the platform was being used primarily as a case management ticketing system no automated playbooks were running in production, connector integrations with the SIEM and EDR platforms were incomplete, and analyst workload hadn’t changed measurably from pre-deployment levels. The deployment existed without the administration and automation capability to make it work. After key SOC staff completed this FortiSOAR Administration Training program, automated phishing triage and malware alert investigation playbooks were deployed within six weeks. Alert-to-investigation time for tier-one incidents dropped significantly, and analysts reported a measurable reduction in the repetitive manual steps that had been consuming the majority of their shift time before automation.
- Why Choose
Why Choose This Program?
Security orchestration, automation, and response platforms are only as effective as the people who administer and automate them. A SOAR platform that isn’t integrated with the security toolstack, doesn’t have working playbooks, and isn’t configured to route alerts intelligently is a case management tool with expensive licensing. This program is built around making FortiSOAR work: the integration, automation, and administration discipline that turns a SOAR deployment from a concept into a functioning security operations capability. Explore our deep learning course and other GI Intelligence programs across our training portfolio for a complete view of what we offer.
- Connect
Contact Us
Ready to build FortiSOAR administration and SOC automation capability across your security operations team? Contact us for upcoming dates and in-house training solutions tailored to your organization.
- FAQs
Fequently Asked Questions
What does the FortiSOAR Administration Training program cover?
Five days across FortiSOAR platform architecture and administration, connector integration and security tool orchestration, automated playbook development and incident response automation, case management and alert triage automation, and advanced administration with Fortinet NSE 6 exam preparation with a timed practice examination and structured feedback on Day 5.
Does GII issue the Fortinet NSE 6 FortiSOAR Administrator certification?
No. GII issues a certificate of completion from GII Corporate & Industrial Training Center. The Fortinet NSE 6 – FortiSOAR Administrator certification is awarded by Fortinet upon passing their own examination. This program prepares participants fully for that examination.
Do attendees need prior FortiSOAR or SOAR platform experience?
Security operations or incident response experience is recommended. Prior FortiSOAR experience is helpful but not required; the program covers platform fundamentals, including architecture and administration, before progressing to advanced automation and integration content.
How is this different from a general incident response course?
General incident response courses cover the IR lifecycle, threat hunting, and response methodology. This program focuses specifically on administering and automating response workflows within the FortiSOAR Security Orchestration, Automation, and Response platform, a distinct technical skill set focused on platform administration and SOC automation rather than response methodology itself.
Which organizations benefit most from FortiSOAR administration training?
Security operations centers that have deployed or are evaluating FortiSOAR, organizations experiencing alert fatigue from high-volume security monitoring, and security teams that want to automate tier-one investigation and response workflows see the most direct value from this SOAR platform administration training.
Ready to Level Up Your Skills?
Take your next step with our learning and development programs designed to build real-world skills and unlock new career opportunities.
Course Schedule
Select your preferred date & venue
20 Jan -- 24 Jan
South Africa
GBP 4595/Person
14 Apr -- 18 Apr
KSA
GBP 4595/Person
7 Jul -- 11 Jul
UK
GBP 4595/Person
13 Oct -- 17 Oct
Morocco
GBP 4595/Person
20 Jan -- 24 Jan
South Africa
GBP 3595/Person
14 Apr -- 18 Apr
KSA
GBP 3595/Person
7 Jul -- 11 Jul
UK
GBP 3595/Person
13 Oct -- 17 Oct
Morocco
GBP 3595/Person
Duration
5 Days