NSE 6

FortiAnalyzer Administrator

Part of NSE 6: Secure Networking

Targets: Product version not specified in the blueprint
Blueprint source: Fortinet Training Institute course page (course objectives) ↗

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by fortinet. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat fortinet's own certification portal as the source of truth and verify against it before you book anything.

These objectives come from Fortinet's course page for this product, not from an exam blueprint: Fortinet has not published one for this exam yet. The material is what the course teaches, and an exam blueprint may organise or weight it differently.

Course objectives

1.01 Describe the purpose of FortiAnalyzer
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.02 Describe the FortiAnalyzer operating modes
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.03 Describe logging in a Fortinet Security Fabric environment
On this site: FortiGate Firewall Policies and NAT: Matching Order, SNAT, and DNAT
1.04 Describe the FortiAnalyzer Fabric
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.05 Describe the log file workflow
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.06 Manage administrative domains (ADOMs)
On this site: FortiManager ADOMs and Device Registration: The Database Is the Source of Truth, FortiManager Policy Packages, Installs, and Workspace Mode
Tools: fortios-config-diff-explainer
1.07 Configure network settings
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
1.08 Configure secure administrative access
On this site: FortiGate Initial Configuration: Factory State, Access, and Operation Modes
1.09 Configure two-factor authentication
On this site: FortiGate Firewall Authentication and FSSO: Identity in a Policy
1.10 Monitor administrative events
On this site: FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks, FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
1.11 Register and manage devices
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
1.12 Perform a system configuration backup
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
Tools: fortios-config-diff-explainer
1.13 Monitor disk usage
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
1.14 Enable and create ADOMs
On this site: FortiManager ADOMs and Device Registration: The Database Is the Source of Truth, FortiManager Policy Packages, Installs, and Workspace Mode
Tools: fortios-config-diff-explainer
1.15 Describe Fabric connectors
On this site: FortiSOAR Playbooks, Jinja, and Connectors, FortiSOAR Incident Workflow, Queues, War Rooms, and Debugging Playbooks, FortiGate Firewall Policies and NAT: Matching Order, SNAT, and DNAT
1.16 Configure log redundancy and encryption
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.17 Configure log rollover and retention policies
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.18 Manage reports
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.19 Prepare firmware upgrade
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
1.20 Configure and manage high-availability clusters
On this site: FortiGate FGCP High Availability: Active-Passive, Active-Active, and Failover
Tools: fortigate-ha-failover-simulator
1.21 Perform system maintenance tasks
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split
1.22 Perform log backups
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →