Security Automation Service objects
The FortiAnalyzer Security Automation Service includes support for the RHSP FortiGuard package which is used to share updated reports, event handlers, SIEM parsers, and playbooks as content packages. RHSP FortiGuard package objects are only applied with a valid Security Automation Service license.
You can find the Security Automation Service objects received as part of the RHSP FortiGuard package in the following places in FortiAnalyzer:
- Reports:
- Reports included in the RHSP package are stored on the global level, and are displayed in the global Security Automation Reports folder.
- The global folder and global reports are identified with the system theme's color applied to the icon.
- Reports delivered by the RHSP package display FortiGuard in the Origin column.
- Event handlers:
- Event handlers delivered by the RHSP package are displayed in Incidents & Events > Handlers > Basic Handlers.
- Event handlers delivered by the RHSP package are displayed in Incidents & Events > Handlers > Basic Handlers.
- SIEM parsers:
- SIEM parsers delivered by the RHSP package are displayed in Incidents & Events > Log Parsers, and display FortiGuard in the Origin column.
- SIEM parsers delivered by the RHSP package are displayed in Incidents & Events > Log Parsers, and display FortiGuard in the Origin column.
- Playbooks:
- Playbooks delivered by the RHSP package are displayed in Fabric View > Automation > Playbook.
- Playbooks delivered by the RHSP package are displayed in Fabric View > Automation > Playbook.