Skip to main content
MamunAunick
MamunAunick
New Member
December 1, 2024
Question

Need help for FortiSOAR response via firewall

  • December 1, 2024
  • 2 replies
  • 834 views

I have FortiSIEM, FortiSOAR and CheckPoint firewall. Connected FortiSIEM and CheckPoint firewall with FortiSOAR through connector. Now can anyone please guide me that how can I take action from SOAR.

 

For example:

SIEM detects a brute force attempt. SOAR ingest data from SIEM. Now I want soar to take action against the attacker through checkpoint firewall. eg: block IP/block url.

FortiSOAR FortiSIEM 

2 replies

sjoshi
Staff
sjoshi
Staff
December 1, 2024

Hi,

 

You can refer below article:-

https://docs.fortinet.com/document/fortisoar/7.6.0/connectors-guide/929681/introduction-to-connectors#Role-based_Access_Control_for_connector_actions

Thanks, Salon
    asolbri2
    asolbri2
    New Member
    December 1, 2024

    FortiEDR is a good choice for endpoint protection. FortiSOAR is really great product, but a big company play, or if you have the staff, SOC as a service play, not really suitable for smaller businesses due to cost and up front complexity (someone has to configure it, and maintain it). Consider who will be feeding and taking care of this before positioning. FortiAnalyzer SOCaaS might be a better play https://tutuapp.uno/  .

    Terms & ConditionsAccessibility statement