Add operation permissions to Admin profile

FortiSoC profile permissions grant administrators access to the FortiSoC module, while preventing them from making changes to the configuration that could affect the SLA.

To create a FortiSoC Admin profile:

1. Go to System Settings > Admin > Profile > Create New.

   

2. Configure the FortiSoC profile.
   1. Name the profile, Profile1.
   2. Set FortSOC to None.
   3. Set Create & Update Incidents, Triage Event, Execute Playbook, and Run Report to Read-Write.
   4. Click OK.

   

3. Apply the profile to an administrator account.
   1. Go to System Settings > Admin > Administrators > Create New.
   2. Name the new profile Admin1, and then select Profile1 from the Admin Profile dropdown.
   3. Click OK.

   

4. Log out of FortiAnalyzer and then log back in as Admin1. The FortiSoC module is not available. Log out of the account.

   

5. Log into FortiAnalyzer as an administrator, and go to System Settings > Admin > Profile.
6. Edit Profile1.
7. Set FortiSOC to Read-Only, and then click OK.

   

8. Log out of FortiAnalyzer, and then log back in as Admin1.
9. Go to FortiSoC > Incidents. You can view and create incidents.

   

10. Go to FortiSoC > All Events. You can acknowledge, comment on, and create a new incident.

    

11. Go to FortiSoC > Playbook. You can now view and run a playbook.

    

12. Go to Reports > All Reports. You can view, run, and export FortiSoC reports.