An in-depth look at how Fortinet’s FortiSOAR automation framework performs comprehensive security validation for newly deployed virtual machines—integrating with FortiEDR, FortiSIEM, FortiEMS, FortiPAM, NetBox/IPAM for asset assurance, and Nessus for vulnerability and compliance verification—to enforce enterprise-grade security hygiene and visibility.
A. Introduction
In modern cybersecurity operations, VM deployment is merely an initiation point. The critical focus is on enforcing defense-in-depth and zero trust principles ensuring every new asset is seamlessly onboarded into the enterprise's security control plane across EDR, SIEM, PAM, asset inventory, and vulnerability scanning.
Manual validation creates security drift, expands the attack surface, and weakens compliance posture. To mitigate this, I developed an automated post-onboarding security control validation pipeline using FortiSOAR, orchestrating cross-platform integration with FortiEDR, FortiSIEM, FortiEMS, FortiPAM, NetBox/IPAM, Nessus & JIRA. This automation enforces baseline security controls, accelerates time-to-compliance, and prevents misconfigurations from becoming exploitable exposures, ensuring assets are operationally resilient and cyber-ready from day one.
B. Architecture Overview
FortiSOAR functions as the centralized orchestration and response layer, coordinating security control validation across the enterprise stack. It ingests ticket metadata from JIRA, initiates automated validation workflows against integrated systems including EDR, SIEM, PAM, and vulnerability scanners and executes contextual actions as defined by playbook logic.
C. Workflow Logic: From Trigger to Validation
Each integration contributes a unique control check within a defense-in-depth architecture, orchestrated centrally via FortiSOAR. This automated workflow transforms security validation into a deterministic, scalable, and auditable process, closing visibility gaps and ensuring operational readiness from Day Zero.
01. JIRA Block: Workflow Trigger & Metadata Extraction
The process initiates with a JIRA ticket acting as the primary trigger. FortiSOAR parses ticket details to extract critical metadata such as VM IP, OS type, and environment. These identifiers are then structured into variables for downstream validations, ensuring consistent context across the entire automation pipeline.
02. NetBox Block: Asset Registry Verification
NetBox is queried to validate whether the VM is properly registered in the asset inventory. This step ensures asset traceability and confirms the VM’s existence within the enterprise topology. A corresponding comment is added back into the JIRA ticket for audit visibility.
03. IPAM Block: IP Ownership and Inventory Check
The workflow reaches out to the IPAM system to verify that the assigned IP address is authorized, not duplicated, and correctly tagged. This defends against IP conflicts and reinforces network hygiene. Validation results are recorded in the JIRA thread.
04. FortiEDR Block: Endpoint Detection Enforcement
FortiEDR is consulted to confirm that the VM is protected by an active endpoint sensor, properly grouped, and policy enforced. It checks whether telemetry from the VM is available and mapped, supporting real-time threat detection and endpoint visibility. Any inconsistencies are logged into JIRA.
05. FortiEMS Block: FortiClient Health & Presence
FortiSOAR queries FortiEMS to ensure that FortiClient is installed, registered, and reporting health status for the VM. This affirms host-level control and supports endpoint configuration enforcement. If registration fails or the agent is unhealthy, JIRA is updated with specifics for action.
06. FortiPAM Block: Credential Governance Check
The workflow integrates with FortiPAM to validate whether privileged credentials for the VM are vaulted, rotated, and policy-bound. It verifies access integrity and even attempts password operations (e.g., test login or rotation) if configured. This enforces zero trust principles and eliminates standing privilege exposure. Validation feedback is pushed into JIRA.
07. FortiSIEM Block: Log Visibility Validation
FortiSIEM is polled to confirm that the VM is present in the log pipeline, ingesting and forwarding security events. This ensures SOC visibility, supports event correlation, and guarantees the VM is not operating as a blind spot. All outcomes are documented in the associated JIRA ticket.
08. Nessus Block: Vulnerability & Compliance Scan Execution
The final step involves dynamically launching a Nessus scan on the VM. FortiSOAR handles session authentication, target registration, and scan triggering, ensuring the system is assessed against known vulnerabilities and compliance baselines. This fulfills security assurance before the VM transitions to production. Scan results or gaps are posted to JIRA for tracking.
D. Before & After Automation
The transformative shift from fragmented manual checks to seamless, scalable, and audit-ready automation. FortiSOAR ensures every security control is enforced consistently from Day Zero.
E. Lessons Learned: The True Power of SOAR
- Centralized Control, Decentralized Execution FortiSOAR emerged as the operational nerve center seamlessly integrating with diverse security tools (EDR, SIEM, PAM, IPAM, VA, etc.) to unify fragmented workflows under a single orchestrated framework.
- Resilience Through Automation By removing human dependencies in repetitive tasks, FortiSOAR enhanced security consistency, eliminated configuration drift, and ensured critical checks never fall through the cracks.
- Time Efficiency at Scale What once took hours of coordination across teams now happens in minutes; accurately; freeing analysts to focus on threat hunting, not checklists.
- Reduced Errors, Increased Confidence Automating validations significantly reduced manual oversight, enhanced response accuracy, and built a stronger baseline of operational trust.
- Scalable Architecture Enablement This framework didn't just solve today's gaps it laid the foundation for a scalable, adaptive security architecture. With SOAR as the core, new controls, tools, and use cases can be plugged in effortlessly.
F. Conclusion: Security at Speed and Scale
In today’s dynamic threat landscape, securing newly provisioned infrastructure isn’t an enhancement—it’s a non-negotiable foundation. Manual, fragmented validation is no longer viable. By operationalizing post-onboarding checks through FortiSOAR, we’ve shifted from reactive oversight to automated, policy-enforced assurance—executed with precision, audited with clarity, and scaled with confidence.
This isn’t just automation—it’s cyber resilience by design. It transforms compliance into code, visibility into verification, and readiness into reality. As environments expand, this model ensures that every VM is not only deployed—but defended, documented, and decisively aligned with enterprise trust boundaries.
Acknowledgment:
I’d like to extend my heartfelt thanks to Michael Zhong, Dawood Sajjadi, Himanshu Modi, Sagar Thakkar, Kosala Kandawela ,Alam Femina Paaul Joseph, Varshil Joshi for their invaluable guidance and support, unwavering trust, and for providing me with the opportunity to lead and deliver on this initiative. Their belief in my capability has been instrumental in shaping this work.
