Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Creating FortiSOC administrator profiles

FortiSOC profile permissions allow security analysts to access the FortiSOC module while preventing them from making changes to configurations that will affect the SLA.

To create an analyst profile:
  1. Go to System Settings > Admin > Profile.
  2. In the toolbar, click Create New.
  3. In the Profile Name field, give the profile a distinctive name such as, Analyst.
  4. Set FortiSOC to Read-Only.
  5. Set one or more of the following settings to Read-Write.
    PermissionDescription
    Create & Update IncidentsAllows analysts to create and update incidents.
    Triage EventAllows analysts to acknowledge, comment, view logs, create new incidents, and add to existing incidents.
    Execute PlaybookAllows analysts to view and run a playbook.
    Run ReportAllows analysts to view, run, and export a report.
  6. Configure the other settings as required, and click OK.
To apply a profile to an administrator:
  1. Go to System Settings > Administrators.
  2. Create a new administrator or edit an existing administrator. The Edit Administrator pane is displayed.
  3. From the Admin Profile list, select a profile.

Creating FortiSOC administrator profiles

FortiSOC profile permissions allow security analysts to access the FortiSOC module while preventing them from making changes to configurations that will affect the SLA.

To create an analyst profile:
  1. Go to System Settings > Admin > Profile.
  2. In the toolbar, click Create New.
  3. In the Profile Name field, give the profile a distinctive name such as, Analyst.
  4. Set FortiSOC to Read-Only.
  5. Set one or more of the following settings to Read-Write.
    PermissionDescription
    Create & Update IncidentsAllows analysts to create and update incidents.
    Triage EventAllows analysts to acknowledge, comment, view logs, create new incidents, and add to existing incidents.
    Execute PlaybookAllows analysts to view and run a playbook.
    Run ReportAllows analysts to view, run, and export a report.
  6. Configure the other settings as required, and click OK.
To apply a profile to an administrator:
  1. Go to System Settings > Administrators.
  2. Create a new administrator or edit an existing administrator. The Edit Administrator pane is displayed.
  3. From the Admin Profile list, select a profile.