vendor hub
Fortinet
Everything on ronutz.com for Fortinet, through one door: its tools, grouped by family, and its articles, and where they exist its certification guides, a reading path, the career chapter, the industry record and the lineage. Tools compute locally in your browser; articles are grounded in vendor documentation.
Working with Fortinet →
The career chapter: what the work with Fortinet actually was, which accounts, which escalations, and what it certified.
The Fortinet story in the industry section →
How Fortinet got here: the acquisitions, the pivots, and the people whose work ended up inside the platform.
Fortinet lineage →
What Fortinet is made of, and who made it. Every acquisition below is verified against primary sources, with the product line it turned into where that connection is documented rather than inferred.
Certification prep
Tools (11)
FortiGate / FortiOS
FortiGate HA failover simulator
Describe an FGCP cluster and see which unit becomes primary, which criterion decided it, and who would be primary if override were toggled.
NätverkFortiGate IPsec phase mismatch analyzer
Describe both IPsec peers and get the disagreement named, and which phase would fail. Phase 1 and phase 2 fail for different reasons and lead to different diagnostics.
Security & WAFFortiGate policy lookup explainer
Paste a FortiGate policy list and a packet, and see which policy matches, why each earlier policy did not, and which policies below the match can never take effect as ordered.
Security & WAFFortiGate policy match-order explainer
Paste an ordered FortiGate policy list and, optionally, a packet, and see which policy wins and why. It walks the list top-down showing the first field that ruled each policy out, names the policies that can never be reached because something broader sits above them, and applies the virtual-IP matching rules that ordering alone does not solve. Local and offline.
Security & WAFFortiGate route selection explainer
Give a destination and a set of routes and see which install, which is selected, and which are floating backups absent from the forwarding table.
NätverkFortiGate security profile coverage checker
Answers why is my profile not working before the ticket is raised. Walks the dependency chain and names which link failed.
Security & WAFFortiGate session table explainer
Paste diagnose sys session list output and have it read back: which policy admitted the flow, what was translated on each leg, and whether the far side ever replied.
NätverkFortiOS CLI config explainer
Paste a FortiOS config block and get the structure as a tree with every verb explained. It flags the trap that costs the most: `set` on a multi-value field REPLACES the whole list, so setting one source address on a policy that had four silently removes three. It also catches unclosed blocks and reminds you that `end` is what commits. Local and offline.
Operations & FieldcraftFortiOS config diff explainer
Two configurations in, a structural diff out. A moved block is not a change, except in the sections where order is the behaviour.
NätverkFortiOS debug flow builder
Assembles the ordered `diagnose debug flow` sequence a FortiGate needs to trace a session: the clean-state reset, the filter, the display options, the packet-count trace and the enable, with the cleanup commands that matter more than the setup. Local and offline; it generates text and contacts nothing.
Security & WAFFortiOS packet sniffer builder
Build a FortiGate diagnose sniffer packet command from parts, or paste one to have every argument explained: interface, filter, verbosity 1-6, count, and timestamp format.
Nätverk
Articles (73)
FortiGate / FortiOS
Carrier-Scale NAT, MAP-E, Domain Fronting, and WCCP
Four features that show up at the edges of a FortiGate deployment: two that exist because IPv4 addresses ran out, one that closes an evasion technique which hides inside legitimate infrastructure, and one that redirects traffic to a proxy without changing how clients are configured.
NätverkReadFive SSE Vendors, One Decision, Five Different Answers
Every secure service edge has to answer the same question: does this flow pass. Zscaler, Netskope, F5 Distributed Cloud, FortiSASE and Prisma Access answer it with genuinely different machinery, and the differences are where migrations go wrong.
Security & WAFReadFortiGate FGCP High Availability: Active-Passive, Active-Active, and Failover
FGCP clusters two or more FortiGates so one can take over from another. Which unit becomes primary is decided by an override-sensitive election, session survival depends on what was being synchronised, and the most common surprise is that inspected sessions do not always survive a failover. This covers the two modes, the election order, heartbeat and session synchronisation, and split brain.
NätverkReadFortiGate Firewall Authentication and FSSO: Identity in a Policy
Putting a user rather than an IP address in a firewall policy requires the FortiGate to know who is behind an address. It can ask directly through active authentication, or learn it silently from a directory through FSSO. This covers the authentication methods, the difference between active and passive identification, how the FSSO collector learns logons, and the failure modes each approach has.
Security & WAFReadFortiGate Firewall Policies and NAT: Matching Order, SNAT, and DNAT
A FortiGate evaluates firewall policies top to bottom and stops at the first match, which makes policy order a functional property rather than a cosmetic one. This covers how a policy is matched, the difference between policy-based NAT and central NAT, how source NAT is chosen through IP pools, and why destination NAT through a VIP changes what the policy must be written against.
Security & WAFReadFortiGate in the Cloud and FortiSASE: Deployment Models and Onboarding
FortiGate exists in the public cloud in two quite different shapes: a virtual machine you deploy and operate yourself, and FortiGate CNF, a managed service where Fortinet operates the firewall. FortiSASE is different again, delivering inspection from Fortinet's points of presence to users wherever they are. This covers what distinguishes each, how licensing differs, and the ways users are onboarded to SASE.
CloudReadFortiGate Initial Configuration: Factory State, Access, and Operation Modes
A FortiGate out of the box has a known factory state, and the first decisions made against it are hard to change later: NAT versus transparent operation mode, whether VDOMs are enabled, and how administrative access is reached. This covers the factory defaults, the difference between the two operation modes, what enabling VDOMs actually does, and the administrative-access settings that most often lock someone out.
NätverkReadFortiGate IPsec VPN: Phase 1, Phase 2, and Redundant Topologies
An IPsec tunnel is negotiated in two phases, and knowing which phase failed narrows a fault immediately. Beyond a single tunnel, the choice between full mesh, hub and spoke, and partially redundant designs is a trade between the number of tunnels to manage and the path traffic actually takes. This covers the phases, the mismatches that break each one, and how redundancy is expressed.
NätverkReadFortiGate Logging and Diagnostics: Where Logs Go and How to Find a Problem
A FortiGate can log to several destinations with very different retention and searchability, and a policy that is not logging produces nothing to investigate. When something is wrong, a small set of commands answers most questions faster than reading configuration does.
NätverkReadFortiGate Routing and SD-WAN: Route Selection Order and Rule Evaluation
A FortiGate chooses an egress path in a defined order: policy routes are consulted before the routing table, and within the routing table the most specific prefix wins, with distance breaking ties between protocols and priority breaking ties within one. SD-WAN adds a rule layer on top that selects a member by measured performance. This covers that order, what distance and priority actually do, and how SD-WAN rules and health checks interact.
NätverkReadFortiGate Security Profiles: Antivirus, IPS, and Application Control
Antivirus, IPS, and application control are separate security profiles attached to a firewall policy, and what each can actually see depends on two things the exam tests directly: the inspection mode the profile runs in, and whether SSL inspection decrypts the traffic first. This covers flow versus proxy inspection, the antivirus scanning modes, how IPS signatures and rate-based actions differ, and why application control sometimes cannot identify an application at all.
Security & WAFReadFortiGate SSL Inspection: Certificate vs Deep Inspection
A FortiGate inspects encrypted traffic in one of two modes: certificate inspection reads only the SNI and the certificate to make a filtering decision without decrypting, while deep (full) inspection is a full man-in-the-middle that decrypts, inspects, and re-encrypts. This maps FortiGate's SSL/SSH inspection profiles onto the generic forward-proxy interception model and covers the flow-versus-proxy engine split that shapes what each can do.
Security & WAFReadFortiGate Traffic Shaping and QoS: Guaranteeing Bandwidth That Is Already Full
Shaping only matters when a link is congested, because until then everything gets through. What it decides is who suffers when there is not enough, and the recurring mistake is guaranteeing more than the link has and calling it a policy.
NätverkReadHow to evaluate competing firewall proposals
Three firewall proposals arrive, each with a datasheet throughput, a licence bundle and a reference customer, and none of them answers the question you have, which is what each would do in your network, with your traffic, run by your team. A method for comparing them on the same terms: how to normalise throughput claims, what a licence really counts, where high availability differs, what the migration of your existing rule base will cost, and how to score the three so that the scoring, not the discount, decides.
Operations & FieldcraftReadReading a FortiGate debug flow
The diagnose debug flow sequence is a recipe, not a command: why the order matters, why the cleanup matters more, what the packet count really counts, and the hardware-offload reason a correct trace can show nothing at all.
Operations & FieldcraftReadReading a FortiGate Packet Sniffer Trace
The FortiGate diagnose sniffer packet command packs five positional arguments into one line: interface, filter, verbosity, count, and timestamp format. This explains what each argument does, what the six verbosity levels actually print, why a capture sometimes shows nothing (VLAN-tag stripping and hardware offload), and how to turn the output into a pcap for Wireshark.
NätverkReadStatic routes, longest prefix match and administrative distance: how a router chooses between answers
A router often holds several answers for one packet, and three rules decide between them at two different moments: the metric chooses the best path inside one protocol, administrative distance chooses which source to believe when two offer the same prefix, and longest prefix match chooses, packet by packet, the most specific of the routes that were installed. With static routes, floating backups, recursive next hops and the failover that silently does not happen, read from RFC 1812 and the vendors' own documents.
NätverkReadThe FortiOS CLI verb that quietly deletes things
config, edit, set, next, end: a small grammar with three traps. `set` replaces a whole list, `edit` creates what it cannot find, and `end` is the only line that commits.
Operations & FieldcraftReadWhy your FortiGate rule did not fire
First match wins and evaluation stops, so a broader rule above makes a narrower one below unreachable. Plus the two things Fortinet documents and people still miss: the policy ID is not the order, and each direction needs its own policy.
Security & WAFRead
FortiAnalyzer
FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
FortiAnalyzer receives logs, parses them into structured fields, and stores them in two very different ways. The analytics store is indexed and searchable; the archive is compressed and is not. Almost every FortiAnalyzer surprise, from a report that returns nothing to a search that finds no logs for last quarter, comes from that split and from the data policy that governs it.
Security & WAFReadFortiAnalyzer Reports: Datasets, Charts, and Why a Report Comes Back Empty
A FortiAnalyzer report is built in layers: a dataset is a query, a chart renders one dataset, and a report lays out charts. Knowing which layer you are editing is the difference between fixing a report in a minute and rebuilding one that was never broken. An empty report is almost always the dataset finding nothing, and there are only a few reasons that happens.
Security & WAFReadFortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
A log is a record. An event is a log that matched a rule you wrote. An incident groups events into something a person works. Playbooks act on them. Getting those four levels straight is most of what the SOC side of FortiAnalyzer asks of you, and it explains why an event handler that looks correct produces nothing.
Security & WAFRead
FortiManager
FortiManager ADOMs and Device Registration: The Database Is the Source of Truth
FortiManager keeps its own copy of every managed device's configuration, and that copy is what gets installed. Understanding that one relationship, and the ADOM that scopes it, explains device registration, the out-of-sync state, ADOM versioning, and why the global database exists.
Operations & FieldcraftReadFortiManager Policy Packages, Installs, and Workspace Mode
A policy package is a set of policies that gets installed to one or more devices. Between editing it and the device changing, there is an install preview worth reading, a locking model worth understanding, and a set of failure modes that all look like the install just did not work.
Operations & FieldcraftReadFortiManager Scripts, Revision History, and Troubleshooting Installs
When a FortiManager change does not land, the answer is almost always in one of three places: the install log, the revision history, or the sync status. Scripts add a fourth way to change things and a fourth way to be surprised. This covers what each is for and the order to check them in.
Operations & FieldcraftRead
FortiSwitch
FortiSwitch and FortiLink: Provisioning, Topologies, and When the Switch Will Not Come Up
FortiLink turns a FortiGate into the switch controller, which means the switch stops being a device you configure and becomes one the firewall configures for you. That shift explains the provisioning flow, the supported topologies, and nearly every FortiLink fault, which almost always resolves to discovery, authorization, or a port that is not what FortiLink expects.
NätverkReadFortiSwitch Port Security, Antispoofing, and Getting Information Out of the Switch
Port security decides which devices may use a port; antispoofing decides whether a device may claim an address it does not own. Both live on the access layer where untrusted devices connect, and both fail in ways that look like the network is broken rather than like security is working.
Security & WAFReadFortiSwitch VLANs, Spanning Tree, Ports, and QoS
The day-to-day work on a managed FortiSwitch is VLANs, port configuration and loop prevention. Each has one detail that catches people: VLANs are created on the FortiGate, spanning tree is on by default and its protections are not, split ports change the port count, and QoS does nothing until something is trusted to mark the traffic.
NätverkRead
FortiAP
FortiAP Deployment: Wireless Fundamentals, the Integrated Controller, and AP Profiles
A FortiAP managed by a FortiGate is configured almost entirely through profiles rather than per device, which is what makes a fleet manageable. Understanding the radio fundamentals underneath those profiles is what stops the settings from being guesses, because most wireless complaints are radio problems wearing a configuration costume.
NätverkReadFortiAP Monitoring, Wireless Threats, and Troubleshooting What Users Actually Report
Users report that the Wi-Fi is slow. That sentence covers coverage problems, congestion, interference, roaming failures, and things that are not wireless at all. Separating them takes a handful of readings, and knowing which reading distinguishes which cause is most of wireless troubleshooting.
NätverkReadSecure Wireless Access on FortiAP: Authentication, VLANs, and NAC
Securing a wireless network is two decisions: how a client proves who it is, and which segment it lands in once it has. Enterprise authentication and dynamic VLAN assignment together make one SSID serve many populations, which is almost always better than one SSID per group.
Security & WAFRead
FortiNAC
FortiNAC Device Modeling and Profiling: Knowing What Is on the Network
FortiNAC cannot control what it cannot identify. Modeling the infrastructure teaches it which switches and controllers to talk to and how; profiling classifies the endpoints that appear on those ports. Both are prerequisites for every policy decision that follows, which is why so much NAC troubleshooting ends up here.
Security & WAFReadFortiNAC Isolation Networks, Access Control, and Onboarding Guests and Contractors
Once FortiNAC knows what an endpoint is, it decides where that endpoint may go. Isolation networks are where unknown and non-compliant devices land, access policies decide the destination, and onboarding covers the people who are not employees. The recurring theme is that isolation only works if the isolated device can still reach what it needs to become compliant.
Security & WAFRead
More
ACME on FortiGate: a built-in client for the box's own certificate
How FortiOS's native ACME support obtains and renews a Let's Encrypt certificate for the FortiGate itself: the public-IP and FQDN requirements, the single-name SAN constraint, the TLS-ALPN-01 and HTTP-01 challenges (and which FortiOS versions support them), the GUI and CLI configuration, and how this differs from BIG-IP's native client.
Certifikat och PKIReadFortiADC Security: WAF, Adaptive Learning, DNS Services, and Diagnosing Delivery
An ADC in the traffic path can enforce as well as distribute, which makes it a natural place for web application protection and DNS-based distribution. Diagnosis follows the same order every time, and knowing it separates a genuine backend fault from the controller doing its job.
Security & WAFReadFortiADC: Application Delivery, Server Load Balancing, and Health Checks
An application delivery controller decides which server gets each request and stops sending traffic to servers that cannot serve it. Most delivery problems are one of two things: a health check that tests the wrong thing, or persistence that a stateful application needed and did not get.
NätverkReadFortiADC: Server Load Balancing, Persistence, and Application Delivery
An application delivery controller sits in front of servers and decides which one receives each request. The configuration hierarchy is small, and two decisions inside it, the balancing method and the persistence rule, determine whether a stateful application works or fails in ways that look random.
NätverkReadFortiAppSec Cloud: Client-Side Protection, Behavioural Detection, GSLB, and Availability
Beyond the WAF, a cloud application service adds three things the on-premises product cannot: protection for code running in the visitor's browser, behavioural detection that works because the service sees traffic across many customers, and global load balancing that decides which region serves a request before it is made.
CloudReadFortiAppSec Cloud: WAF as a Service, DDoS, and Managed Application Delivery
FortiAppSec Cloud moves web application protection off your equipment and into a service in front of your origin. That changes what you configure, what you can see, and where the failure modes are, and the origin-exposure problem is the one that undoes deployments.
CloudReadFortiClient EMS: Architecture, Deployment Modes, and Endpoint Profiles
EMS is a management server that endpoints check in to, and a profile engine that tells them what to be. Getting the deployment right is mostly about how endpoints find the server and how they are grouped once they do, because a profile applied to the wrong group is the most common reason an endpoint is not doing what you configured.
Security & WAFReadFortiClient EMS: Endpoint Security, Quarantine, ZTNA, and Diagnosing Endpoints
Once endpoints are registered and profiled, EMS becomes a policy and response system. Quarantine isolates a compromised endpoint, ZTNA replaces implicit network trust with per-session verification, and the Fabric connection is what lets a FortiGate act on things only EMS knows.
Security & WAFReadFortiCNAPP: Cloud Posture, Account Integration, and Compliance
A CNAPP exists because cloud risk is not one problem. Misconfiguration, excessive permissions, vulnerable workloads and unsafe infrastructure code are four different failures needing four different views, and the platform's value is holding them together well enough to say which actually matters.
CloudReadFortiCNAPP: Shift-Left, Threat Detection, and Remediating Cloud Risk
Finding a misconfiguration in production is late. Shift-left moves the check to the point where the mistake is cheapest to fix, which is before it is deployed. Runtime detection handles what shifting left cannot prevent, and behavioural baselines are what make cloud threat detection tractable at all.
CloudReadFortiDDoS Protection Policies, Proxy Traffic, and Running It Day to Day
Protection policies scope which rules apply to which traffic, which matters because a public web service and an internal API deserve very different treatment. The hardest operational problem is traffic that arrives through proxies and CDNs, where every request shares a handful of source addresses.
Security & WAFReadFortiDDoS: Detection Versus Prevention, Thresholds, and How Blocking Decides
A DDoS appliance has to tell an attack from a busy Tuesday, and it does that by learning what your traffic normally looks like rather than by recognising signatures. That single design choice explains sizing, the two operating modes, and why the penalty system exists instead of a simple block.
Security & WAFReadFortiDeceptor Deployment: Networks, Air-Gapped Sites, Central Management, and Incident Analysis
A deception deployment has to reach the segments where attackers operate, which frequently includes networks that are isolated by design. The deployment topology, the wizard that assembles it, and the analysis that follows an alert are the practical body of running FortiDeceptor.
Security & WAFReadFortiDeceptor: Decoys, Lures, Tokens, and Designing a Deception Strategy
Deception works on a premise no other control shares: a decoy has no legitimate users, so any interaction with it is suspicious by construction. That single property is why deception produces so few false positives, and it is also the thing a deployment can accidentally destroy.
Security & WAFReadFortiDLP Detection, Investigating Cases, and Diagnosing the Agent
A DLP deployment succeeds or fails on how it handles the cases where a person moved data for a legitimate reason. Actions that are too blunt train people to work around the tool; investigation that lacks context cannot tell the two apart. This covers the response options, the event-to-case escalation, and what to check when the agent is not reporting.
Security & WAFReadFortiDLP: Architecture, Agents, and Knowing Where Your Data Actually Is
Data loss prevention only works where it can see. FortiDLP puts an agent on the endpoint so it observes data at the point of use rather than only in transit, and integrates with SaaS platforms so it sees data that never touches your network. Understanding which vantage point covers what is the difference between coverage and the appearance of it.
Security & WAFReadFortiEDR Architecture: Components, Deployment, Multi-Tenancy, and the Cloud Service
FortiEDR splits detection between what the collector sees on the endpoint and what the cloud service knows about the world. Understanding which component does what explains the deployment topology, why multi-tenancy is structured the way it is, and what happens when the cloud service is unreachable.
Security & WAFReadFortiEDR Policies, Communication Control, and Playbooks
FortiEDR has two policy families that answer different questions: security policies decide what a process may do, and communication control decides which applications may talk to the network. Playbooks decide what happens automatically once something is detected. Each has a simulation mode, and using it is the difference between a rollout and an outage.
Security & WAFReadFortiEDR Threat Hunting, Forensics, and Investigating an Alert
An alert tells you something happened. Investigation answers what happened before it, what it touched, and whether it is still happening. FortiEDR keeps the telemetry that makes those answerable, and threat hunting is how you ask questions of it without waiting for an alert to prompt you.
Security & WAFReadFortiGate as a DNS server: four modes, and where the filter applies
A FortiGate can relay DNS, answer from its own database, or resolve from the root itself. The four modes behave differently under failure, and the DNS filter profile does not apply to all of them - which is the configuration that looks protected and is not.
NätverkReadFortiMail Content Security, Archiving, and Encryption Including IBE
Once a message is accepted, content controls decide what it may contain and encryption decides who may read it. Identity-based encryption is the part worth understanding properly, because it solves the problem that made secure email impractical for decades: sending encrypted mail to someone who has no keys and no software.
Security & WAFReadFortiMail Deployment: SMTP Fundamentals, Operation Modes, and Protected Domains
Which operation mode you choose determines what FortiMail can do and how much of the mail infrastructure changes around it. Understanding SMTP's envelope-versus-header distinction first is what makes the policy model afterwards make sense, because FortiMail matches on the envelope and users see the header.
Security & WAFReadFortiMail Policies and Antispam: Access Control, IP Policies, and Session Filtering
FortiMail evaluates mail through a layered policy model, and knowing which layer acts when explains both why a message was allowed and why a profile you configured never applied. Antispam then works best when the cheap checks run early and the expensive ones run only on what survives.
Security & WAFReadFortiMail Workspace Security: Protecting Microsoft 365 and Google Workspace
Cloud mail platforms already filter mail before you see it, so a second layer has to justify itself. It does so by connecting through the platform's own API rather than the mail path, which means it inspects what arrives after the platform's filtering and can act on mail already sitting in a mailbox.
CloudReadFortiNDR Cloud: Architecture, Sensors, Event Types, and Detections
Network detection and response watches traffic rather than endpoints, which lets it see things no agent can: devices that cannot run one, lateral movement between hosts, and traffic from systems nobody knew existed. Understanding what the sensors capture and how detections are built on it is what makes the results actionable.
Security & WAFReadFortiNDR Cloud: IQL Queries, Threat Hunting, and Integration
The value of retained network metadata is that you can ask it questions after the fact. IQL is how those questions are asked, hunting is the practice of asking them without waiting for an alert, and integration is what lets the answers reach the rest of the SOC rather than staying in one console.
Security & WAFReadFortinet in Public Cloud: Container Protection, Native Integration, and Infrastructure as Code
Protecting cloud workloads means working with the provider's own constructs rather than against them. Containers need protection at a different layer than virtual machines, native services provide telemetry and enforcement points worth using, and infrastructure as code is how any of it stays reproducible.
CloudReadFortiRecon: Attack Surface Management and What the Dark Web Actually Is
External attack surface management answers a question most organisations cannot: what does an attacker see when they look at us. It works from the outside with no credentials and no agents, which is exactly how an attacker starts, and it routinely finds assets nobody knew were exposed.
Security & WAFReadFortiSASE Operations: Onboarding Users, Endpoint Posture, and Reading the Reports
Running a SASE deployment is mostly about getting users onto it and then understanding what it is telling you. Onboarding decides coverage, posture decides what access is granted, and the reports are where a security service either demonstrates its value or produces numbers nobody acts on.
CloudReadFortiSIEM Analytics: Building Queries, Aggregation, and the CMDB
A SIEM search is only as good as what it can join against. FortiSIEM keeps a configuration management database describing what your devices are, and the ability to query events alongside that context is what separates a useful search from a text hunt through log lines.
Security & WAFReadFortiSIEM Machine Learning, UEBA, and Integrating the Rest of the Platform
Rules catch what you thought to describe. Machine learning and user behaviour analytics exist for what you did not, and both work by learning normal and reporting deviation. That makes the learning period a real operational concern, because a baseline built during an incident encodes the incident as normal.
Security & WAFReadFortiSIEM Rules, Subpatterns, and Turning Incidents Into Action
A FortiSIEM rule is built from subpatterns, which is what lets it express conditions a single search cannot: this happened, and then that happened, within this window. Once a rule fires, the work shifts to tuning, notification and remediation, and each of those has a failure mode that quietly makes the SIEM useless.
Security & WAFReadFortiSOAR Architecture and Data Model: Modules, Records, and Relationships
FortiSOAR is a database with automation attached, and almost everything you build sits on its data model. Modules hold records, fields hold values, and relationships connect records across modules. Understanding that before writing a playbook is the difference between automation that composes and automation that is a pile of special cases.
Security & WAFReadFortiSOAR Incident Workflow, Queues, War Rooms, and Debugging Playbooks
The automation exists to serve people working incidents, and the workflow features decide whether that work is orderly. Phases track where an incident is, queues decide who picks it up, and war rooms hold the collaboration. When automation misbehaves, the executed playbook log answers what happened faster than reasoning does.
Security & WAFReadFortiSOAR Playbooks, Jinja, and Connectors
A playbook is a trigger, a sequence of steps, and data flowing between them. Most of the difficulty is in that third part: getting the output of one step into the shape the next one needs, which is what Jinja is for. Connectors are how playbooks reach anything outside FortiSOAR, and connector failures look like playbook failures.
Security & WAFReadFortiWeb Deployment, Server Policies, and Application Delivery
A web application firewall sits in front of applications it did not write and must not break. The deployment mode decides how much it can do and how much risk it introduces, and the server policy is where an application is described well enough for protection to be meaningful.
Security & WAFReadFortiWeb Protection: Signatures, Machine Learning, Bots, APIs, and DoS
Web application protection combines things that recognise known attacks with things that learn what your application normally does. Bots and APIs each need their own treatment, because a bot is not distinguished by its payload and an API has no user to challenge.
Security & WAFReadOperational Technology Security: Why the IT Playbook Does Not Transfer
Industrial networks invert almost every assumption IT security is built on. Availability outranks confidentiality, devices cannot be patched or scanned, and protocols were designed with no authentication because the network was assumed to be physically isolated. Protecting them means working around those facts rather than fixing them.
Security & WAFReadSD-Branch and Overlay Networks: VXLAN, LAN Extension, and Orchestrating Many Sites
A branch is a firewall, some switches and some access points that all have to be configured consistently across hundreds of locations by people who will never visit them. SD-Branch collapses that into one managed unit, and overlay networking is what lets a site's network extend beyond the site.
NätverkReadSOC Architecture and Adversary Behaviour: Attack Vectors and What the Products Are For
A security operations centre is a set of products only incidentally. What makes it work is knowing which questions each product answers, how attackers actually get in, and how to read a sequence of events as behaviour rather than as a list of alerts. This is the frame the rest of the Fortinet SOC material hangs on.
Security & WAFRead