FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
This article describes that the X-Frame-Options header should be set to either DENY or SAMEORIGIN. This header must be included in every HTTP response to fully protect the website. In some cases, systems running v7.4 may be missing the X-Frame-Options header at the root level.
Scope
FortiSOAR v7.4.x.
Solution
Step 1: Log in to the FortiSOAR instance and navigate to the location of the cyops-api.conf file.
# cd /etc/nginx/conf.d/
Step 2: Open the cyops-api.conf file located in /etc/nginx/conf.d/ using a text editor, and locate the location block.
# vi cyops-api.conf
location = /cindex.html {
...
...
}
Step 3: Inside the location block, add the add_header directive to set the X-Frame-Options header. The modified block should look something like this:
location = /cindex.html {
...
...
add_header X-Frame-Options SAMEORIGIN;
...
...
}
Step 4: Save the changes, exit the editor, and restart the Nginx service:
