NSE 6

FortiRecon Analyst

Part of NSE 6: Security Operations

Targets: Product version not specified in the blueprint
Blueprint source: Fortinet Training Institute course page (course objectives) ↗

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by fortinet. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat fortinet's own certification portal as the source of truth and verify against it before you book anything.

These objectives come from Fortinet's course page for this product, not from an exam blueprint: Fortinet has not published one for this exam yet. The material is what the course teaches, and an exam blueprint may organise or weight it differently.

Course objectives

1.01 Describe how to identify the attack surface
Article coming
1.02 Differentiate between the surface web, deep web, and dark web
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.03 Describe the MITRE ATT&CK Matrix and Cyber Kill Chain for Enterprise
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is, SOC Architecture and Adversary Behaviour: Attack Vectors and What the Products Are For
1.04 Describe FortiRecon use cases
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.05 Describe the FortiRecon license and initial access
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.06 Describe the FortiRecon provisioning form and seed data
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.07 Identify FortiRecon managed security service provider (MSSP) onboarding and prerequisites
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.08 Describe the FortiRecon overview page, digital risk posture, and ASM
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.09 Identify FortiRecon exposed services and technologies
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.10 Describe FortiRecon BP and ACI components
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is
1.11 Describe FortiRecon reports, objectives, and data
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.12 Describe automation and FortiRecon Security Orchestration
On this site: FortiSOAR Playbooks, Jinja, and Connectors, FortiSOAR Incident Workflow, Queues, War Rooms, and Debugging Playbooks
1.13 Create and run playbooks
On this site: FortiAnalyzer Log Ingestion: Normalization, and the Analytics/Archive Split, FortiAnalyzer SOC: Event Handlers, Incidents, Indicators, and Playbooks
1.14 Explore APIs and examples
On this site: FortiRecon: Attack Surface Management and What the Dark Web Actually Is

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →