Security Orchestration
The Security Orchestration module helps you investigate and respond to security threat findings from FortiRecon's Attack Surface Management, Brand Protection, and Adversary Centric Intelligence modules. This solution reduces the time responders require to prioritize and take appropriate actions by automating and streamlining security workflows.
Every FortiRecon core subscription includes a standard entitlement of 100 playbook executions per month. You can increase your monthly limit by purchasing Security Orchestration Playbook add-on packs. Each pack adds 2000 executions to your monthly capacity. These licenses are stackable. See Standard FortiRecon Licensing.
Example: If you purchase any one of the core solution bundles—EASM, EASM and BP, or EASM, BP, and ACI, you receive a default entitlement of 100 playbook executions per month.
If you then purchase a Security Orchestration Playbook add-on, your total capacity increases to 2100 executions per month (100 from the core bundle + 2000 from the add-on). Each additional add-on pack stacks an extra 2000 executions onto your monthly limit.
For steps to begin using the pre-defined playbooks, see Getting Started
If you are an existing user of Security Orchestration, you must manually upgrade the FortiRecon Automation Service solution pack. This step is not necessary for new installations or for existing users who have not yet accessed Security Orchestration.
-
To uninstall the older version of solution pack, navigate to Content Hub > Installed tab, apply the Solution Packs filter, select the FortiRecon Automation Service 1.0.0 entry, and then click Delete Template in the dialog box.
-
To install the new version, navigate to Content Hub > Discover tab, apply the Solution Packs filter, search for and select FortiRecon Automation Service 1.0.1, and then click Install in the dialog box.
For more information on managing Solution Packs, see Solution Packs .
The Security Orchestration module contains the following tabs.
| Home | The Home tab provides a quick overview of your Security Orchestration usage and available playbook collections. See Home. |
| Playbooks | The Playbooks tab allows you to create and manage your playbook collections and individual playbooks. See Playbooks Overview. |
| Playbook Assets | The Playbook Assets tab enables you to create and manage global variables and event templates for your playbooks. See Playbook Assets. |
| Content Hub | The Content Hub tab provides Discover and Installed tabs to help you install and manage connectors, widgets, and solution packs. See Content Hub. |
|
Agents |
The Agents tab allows you to create and manage agents. See Agents. |
|
Execution Logs |
The Execution Logs tab allows you view results and debug executed playbooks. See Execution Logs. |
|
Tasks |
The Tasks tab displays a list of automations that are awaiting your input before they can continue their execution. See Tasks. |