Version:

Version:

Version:

Version:


Table of Contents

User Guide

Download PDF
Copy Link

Content Hub

FortiSOAR release 7.2.0 introduces the 'Content Hub' using which you can find, view, install, create, out-of-the-box reference material and product add-ons such as connectors, widgets, and solution packs.

Use the Content Hub from within FortiSOAR to seamlessly browse, build, install, create, and support upgrades for the Solution Packs, Connectors, and Widgets. Prior to release 7.2.0, connectors and widgets used to be managed using different stores, and there was no management of Solution Packs. Now, the 'Content Hub' provides a consolidated place for managing all types of product add-ons.

The Content Hub is also available publicly at: https://fortisoar.contenthub.fortinet.com/, which also provides users with a consolidated view of all the listings of all FortiSOAR add-ons and reference information helping users leverage all that FortiSOAR has to offer more effectively by increasing the utilization of FortiSOAR.

Note

The Content Hub data gets synchronized from the FortiSOAR repository, currently, at the thirtieth minute of every hour (for example, 1:30, 2:30), so that the content displayed in the content hub is always up-to-date.
You must ensure that repo.fortisoar.fortinet.com is reachable from your FortiSOAR instance. Otherwise, you will see a blank page when you click Content Hub in the left navigation. If FortiSOAR is deployed using offline repo, you must ensure that your repo is synchronized with repo.fortisoar.fortinet.com.

Permissions required for using Content Hub

  • To view the Content Hub and changes made in the Content Hub, you must be assigned a role that has a minimum of Read permission on the Content Hub and Applications modules, and a minimum of Create, Read, Update permissions on the Solution Packs module. If users do not have Read permission on the Content Hub module, then such users cannot view the Content Hub and it will not be available in the left navigation.
  • To view the content, i.e., the widgets and connectors that are part of the Content Hub, you must be assigned a role that has a minimum of Read permission on the Content Hub, Solution Pack, Widgets/Connectors, and Applications modules. Apart from this if you need to work (create, edit, delete) with the content, then you need appropriate permissions on the respective modules.
  • To install content from the Content Hub or to or upload content to the Content Hub you must be assigned a role that has a minimum of Read permission on the Security module.
Note

By default, for fresh installations of FortiSOAR the FSR Content Hub role is added and assigned to the 'Playbook Appliance'. Therefore, if you remove the FSR Content Hub role from the playbook appliance, then you must add relevant permissions to the playbook appliance.

Content Hub

Click Content Hub in the FortiSOAR left navigation to display the Content Hub page, which contains a Filter panel on the left and the Discover, Manage, and Create tabs.
Content Hub page

You can use the Search box to search across all the tabs and sort the content alphabetically (A-Z) or by date.

Using the Filters panel, you can filter the content displayed in all the tabs. To clear all your filters, click Clear All. To clear filters for a particular category, click the Clear button in that category. You can use the Search box in each of the filter criteria to search for content in that particular filter criterion. You can collapse or expand the Filters panel, by clicking the << arrows. If you have filtered the content based on any criteria, then you can view the filters that you have added in the Filtered by list.

You can filter content (add-ons) based on the following:

  • Content Type: Filter the content based on the type of content with which you want to work, by selecting the required add-ons from the listed content types. Currently, Connectors, Solution Packs, and Widgets are the add-on content types present in FortiSOAR.
  • Category: Filter the content based on the categorization of the content. Content is categorized based on the type of operations that the add-ons can perform. Examples of categories are Enrichment, Endpoint Management, Malware Analysis, etc.
  • Publisher: Filter the content based on who is the publisher of the add-on. The add-ons can be developed and published by Fortinet or Community (anonymous) or by various contributors such as Bay Dynamic, Eclecticiq, etc.
  • Tags: Filter the content based on the tags (exact match) associated with the content.

The Content Hub page contains the following tabs:

  • Discover: Displays all the add-ons that are available in the Content Hub.
  • Manage: Displays all of your content, i.e., all the add-ons that you have installed on the FortiSOAR instance.
  • Create: Displays the add-ons that you are creating or editing, i.e., it displays the add-ons that you are working on and which are yet not published.

Discover tab

The Discover tab displays all the add-ons that are available in the Content Hub. Click on a tile to open the add-on popup, which displays the information about the add-on and using which you can install and export connectors, solution packs, or widgets.

Note

Users who are upgrading to release 7.2.0 or later from a release prior to 7.2.0, will observe that connectors that they had installed prior to the upgrade are missing from the Content Hub. To resolve this issue, users have to assign appropriate permissions on the Solution Packs module to the 'Playbook Appliance'. For more information, see the "Upgrade Guide."

Manage tab

The Manage tab displays all of your content, i.e., all the add-ons that you have installed on the FortiSOAR instance. It also contains upgrade notifications for any of the add-ons that you have installed. You can search for an add-on by its name in the Search box and sort the add-ons either alphabetically or by date. Similarly, you can filter the installed add-ons that have an upgraded version, by selecting Update Available from the drop-down list.

To upload a custom add-on, connector, widget, or solution pack, click Upload and then select the type of add-on you want to upload:
Uploading an add=on from the My Content page

Clicking Upload > Upload <ContentType> opens the Upload <ContentType> popup, where you can drag-and-drop the .tgz or zip file of the add-on or browse to the .tgz or zip file to add the add-on in FortiSOAR. If you have an existing version of the connector, widget, or solution pack on your system, then you can click the Replace existing version checkbox to replace that version of the connector, widget, or solution pack.

Note

Ensure that all the dependencies for the add-on gets installed. If the dependencies are not installed for connectors, then you can install them using the CLI. In the case of Solution Packs and widgets you can try to install them using the UI.

Click on a tile to open the add-on popup, which displays the information about the add-on, and using which you can perform various actions such as editing, cloning, exporting, uninstalling (or deleting) the add-ons.

Create tab

The Create tab displays the add-ons on which you are currently working and which have not been published:
Workspace tab - Create New Add-on

You can perform the following operations from the add-on card in the Create tab:

  • Edit: This allows you to edit the add-on, which in the case of connectors and widgets opens the code editor interface and in case of solution packs opens the Edit Solution Pack wizard.
  • Add Version: This allows you to add a version for the add-on, which in the case of connectors and widgets opens the Clone <add-on> dialog and in the case of solution packs opens the Clone Solution Pack wizard.

  • Delete: This allows you to delete the add-on.

You can also create new add-ons by clicking Create New and then selecting the type of add-on you want to create. Clicking Create New > New <ContentType> opens the wizard for that particular add-on using which you can create the add-on.

For more information on Widgets and Solution Packs, see the Widgets and Solution Packs chapters respectively, and for Connectors, see the "Connectors Guide."

Content Hub Portal

The Content Hub is also available publicly at: https://fortisoar.contenthub.fortinet.com/, to view out-of-the-box reference material and product add-ons like connectors, playbooks, solution-packs, widgets, etc.

The first section of the Content Hub portal displays FortiSOAR highlights, such as featured solution packs, curated solutions, peer insights reviews from Gartner, etc. It also contains a Search box (minimum three characters are required to search) at the top using which users can search through the complete Content Hub portal:
Content Hub Portal Landing page

The next section contains FortiSOAR solution highlights, information about FortiSOAR community, its forums, etc. The next section contains the Categories for all the reference material and add-ons offered by FortiSOAR, including connectors, solution packs, widgets, etc., and the count of items in each type of category, for example, 408 connectors are present in the Connectors category, 25 solution packs are present in the Solution Pack category and so on:
Content Hub portal page- Latest features and Categories sections

The next section, Latest Updates, contains the latest updates, which displays newly published content from the FortiSOAR repository, therefore if any connector, widget, solution pack, etc., is released then that will be included in this section. The last section contains information and link for users to contribute their connectors, widgets, solution packs to the FortiSOAR Content Hub:
Content Hub portal page - Latest Updates and Builing Custom Add-ons sections
Clicking Visit our GitHub page for more details opens a GIT repository that contains instructions how a user can contribute to the public Content Hub.

Clicking on a category in the Categories section on the Content Hub page brings up the listing page for all the categories:
Content Hub Portal Listing page

You can use the Search box to search across all the tabs. Using the Filters panel, you can filter the content displayed in all the tabs. To clear all your filters, click Clear All. To clear filters for a particular category, click the Clear button in that category. You can use the Search box in each of the filter criteria to search for content in that particular filter criterion.

On the listing page you can filter content based on the following:

  • Content Type: Filter the content based on the type of content you want to view, by selecting the required options from the listed content types. Currently, you can choose from Connectors, Solution Packs, and Widgets.
  • Category: Filter the content based on the categorization of the content. Examples of categories are Analytics and SIEM, Case Management, Endpoint Security, etc.
  • Publisher: Filter the content based on who is the publisher of the content. Content can be developed and published by Fortinet or Community (anonymous) or by various contributors such as Bay Dynamic, Eclecticiq, etc.

Clicking on a card on the Categories Listing page displays the detailed page for that content. For example, clicking on the Service Now connector card opens a page containing a brief introduction about the connector, its version, certification (certified or not), publisher information, the release highlights for that particular version of the connector and link to the connector documentation. It also contains a drop-down list of the previous versions for that connector. Clicking on a previous version opens a page containing information for that version of the connector:
Content Hub portal page - Connector Details

Similarly, clicking on a card in the Latest Updates section on the Content Hub page displays the detailed page for that content. For example, clicking on the Brute Force Attack Response solution pack card (or clicking the Learn More button) opens a page containing a brief introduction about the solution pack, and links to various reference information for that solution pack. It also contains a link to the GitHub repository (if the solution pack is on a public GitHub repo) for that solution pack and a Version drop-down list of previously available versions for that solution pack. Clicking on a previous version opens a new page containing information for that version of the solution pack:
Content Hub Portal page - Solution Pack details

You can also experience the Content Hub portal on your mobile and with the same pages, listings, and details as is present in a browser

Troubleshooting Tips

Unable to see updates for your entities in Content Hub

If you are unable to see updates for your entities such as connectors, widgets, etc. in Content Hub, it could be because the Content Hub data is not synced with the FortiSOAR repository.

Resolution

To resolve this issue, you can wait for the next synchronization cycle between Content Hub and the FortiSOAR repository. The Content Hub data gets synchronized from the FortiSOAR repository, currently, at the thirtieth minute of every hour (for example, 1:30, 2:30).

Or, you can manually force the synchronization using the following command:
sudo -u nginx php /opt/cyops-api/bin/console app:contenthub:sync --force

Content Hub

FortiSOAR release 7.2.0 introduces the 'Content Hub' using which you can find, view, install, create, out-of-the-box reference material and product add-ons such as connectors, widgets, and solution packs.

Use the Content Hub from within FortiSOAR to seamlessly browse, build, install, create, and support upgrades for the Solution Packs, Connectors, and Widgets. Prior to release 7.2.0, connectors and widgets used to be managed using different stores, and there was no management of Solution Packs. Now, the 'Content Hub' provides a consolidated place for managing all types of product add-ons.

The Content Hub is also available publicly at: https://fortisoar.contenthub.fortinet.com/, which also provides users with a consolidated view of all the listings of all FortiSOAR add-ons and reference information helping users leverage all that FortiSOAR has to offer more effectively by increasing the utilization of FortiSOAR.

Note

The Content Hub data gets synchronized from the FortiSOAR repository, currently, at the thirtieth minute of every hour (for example, 1:30, 2:30), so that the content displayed in the content hub is always up-to-date.
You must ensure that repo.fortisoar.fortinet.com is reachable from your FortiSOAR instance. Otherwise, you will see a blank page when you click Content Hub in the left navigation. If FortiSOAR is deployed using offline repo, you must ensure that your repo is synchronized with repo.fortisoar.fortinet.com.

Permissions required for using Content Hub

  • To view the Content Hub and changes made in the Content Hub, you must be assigned a role that has a minimum of Read permission on the Content Hub and Applications modules, and a minimum of Create, Read, Update permissions on the Solution Packs module. If users do not have Read permission on the Content Hub module, then such users cannot view the Content Hub and it will not be available in the left navigation.
  • To view the content, i.e., the widgets and connectors that are part of the Content Hub, you must be assigned a role that has a minimum of Read permission on the Content Hub, Solution Pack, Widgets/Connectors, and Applications modules. Apart from this if you need to work (create, edit, delete) with the content, then you need appropriate permissions on the respective modules.
  • To install content from the Content Hub or to or upload content to the Content Hub you must be assigned a role that has a minimum of Read permission on the Security module.
Note

By default, for fresh installations of FortiSOAR the FSR Content Hub role is added and assigned to the 'Playbook Appliance'. Therefore, if you remove the FSR Content Hub role from the playbook appliance, then you must add relevant permissions to the playbook appliance.

Content Hub

Click Content Hub in the FortiSOAR left navigation to display the Content Hub page, which contains a Filter panel on the left and the Discover, Manage, and Create tabs.
Content Hub page

You can use the Search box to search across all the tabs and sort the content alphabetically (A-Z) or by date.

Using the Filters panel, you can filter the content displayed in all the tabs. To clear all your filters, click Clear All. To clear filters for a particular category, click the Clear button in that category. You can use the Search box in each of the filter criteria to search for content in that particular filter criterion. You can collapse or expand the Filters panel, by clicking the << arrows. If you have filtered the content based on any criteria, then you can view the filters that you have added in the Filtered by list.

You can filter content (add-ons) based on the following:

  • Content Type: Filter the content based on the type of content with which you want to work, by selecting the required add-ons from the listed content types. Currently, Connectors, Solution Packs, and Widgets are the add-on content types present in FortiSOAR.
  • Category: Filter the content based on the categorization of the content. Content is categorized based on the type of operations that the add-ons can perform. Examples of categories are Enrichment, Endpoint Management, Malware Analysis, etc.
  • Publisher: Filter the content based on who is the publisher of the add-on. The add-ons can be developed and published by Fortinet or Community (anonymous) or by various contributors such as Bay Dynamic, Eclecticiq, etc.
  • Tags: Filter the content based on the tags (exact match) associated with the content.

The Content Hub page contains the following tabs:

  • Discover: Displays all the add-ons that are available in the Content Hub.
  • Manage: Displays all of your content, i.e., all the add-ons that you have installed on the FortiSOAR instance.
  • Create: Displays the add-ons that you are creating or editing, i.e., it displays the add-ons that you are working on and which are yet not published.

Discover tab

The Discover tab displays all the add-ons that are available in the Content Hub. Click on a tile to open the add-on popup, which displays the information about the add-on and using which you can install and export connectors, solution packs, or widgets.

Note

Users who are upgrading to release 7.2.0 or later from a release prior to 7.2.0, will observe that connectors that they had installed prior to the upgrade are missing from the Content Hub. To resolve this issue, users have to assign appropriate permissions on the Solution Packs module to the 'Playbook Appliance'. For more information, see the "Upgrade Guide."

Manage tab

The Manage tab displays all of your content, i.e., all the add-ons that you have installed on the FortiSOAR instance. It also contains upgrade notifications for any of the add-ons that you have installed. You can search for an add-on by its name in the Search box and sort the add-ons either alphabetically or by date. Similarly, you can filter the installed add-ons that have an upgraded version, by selecting Update Available from the drop-down list.

To upload a custom add-on, connector, widget, or solution pack, click Upload and then select the type of add-on you want to upload:
Uploading an add=on from the My Content page

Clicking Upload > Upload <ContentType> opens the Upload <ContentType> popup, where you can drag-and-drop the .tgz or zip file of the add-on or browse to the .tgz or zip file to add the add-on in FortiSOAR. If you have an existing version of the connector, widget, or solution pack on your system, then you can click the Replace existing version checkbox to replace that version of the connector, widget, or solution pack.

Note

Ensure that all the dependencies for the add-on gets installed. If the dependencies are not installed for connectors, then you can install them using the CLI. In the case of Solution Packs and widgets you can try to install them using the UI.

Click on a tile to open the add-on popup, which displays the information about the add-on, and using which you can perform various actions such as editing, cloning, exporting, uninstalling (or deleting) the add-ons.

Create tab

The Create tab displays the add-ons on which you are currently working and which have not been published:
Workspace tab - Create New Add-on

You can perform the following operations from the add-on card in the Create tab:

  • Edit: This allows you to edit the add-on, which in the case of connectors and widgets opens the code editor interface and in case of solution packs opens the Edit Solution Pack wizard.
  • Add Version: This allows you to add a version for the add-on, which in the case of connectors and widgets opens the Clone <add-on> dialog and in the case of solution packs opens the Clone Solution Pack wizard.

  • Delete: This allows you to delete the add-on.

You can also create new add-ons by clicking Create New and then selecting the type of add-on you want to create. Clicking Create New > New <ContentType> opens the wizard for that particular add-on using which you can create the add-on.

For more information on Widgets and Solution Packs, see the Widgets and Solution Packs chapters respectively, and for Connectors, see the "Connectors Guide."

Content Hub Portal

The Content Hub is also available publicly at: https://fortisoar.contenthub.fortinet.com/, to view out-of-the-box reference material and product add-ons like connectors, playbooks, solution-packs, widgets, etc.

The first section of the Content Hub portal displays FortiSOAR highlights, such as featured solution packs, curated solutions, peer insights reviews from Gartner, etc. It also contains a Search box (minimum three characters are required to search) at the top using which users can search through the complete Content Hub portal:
Content Hub Portal Landing page

The next section contains FortiSOAR solution highlights, information about FortiSOAR community, its forums, etc. The next section contains the Categories for all the reference material and add-ons offered by FortiSOAR, including connectors, solution packs, widgets, etc., and the count of items in each type of category, for example, 408 connectors are present in the Connectors category, 25 solution packs are present in the Solution Pack category and so on:
Content Hub portal page- Latest features and Categories sections

The next section, Latest Updates, contains the latest updates, which displays newly published content from the FortiSOAR repository, therefore if any connector, widget, solution pack, etc., is released then that will be included in this section. The last section contains information and link for users to contribute their connectors, widgets, solution packs to the FortiSOAR Content Hub:
Content Hub portal page - Latest Updates and Builing Custom Add-ons sections
Clicking Visit our GitHub page for more details opens a GIT repository that contains instructions how a user can contribute to the public Content Hub.

Clicking on a category in the Categories section on the Content Hub page brings up the listing page for all the categories:
Content Hub Portal Listing page

You can use the Search box to search across all the tabs. Using the Filters panel, you can filter the content displayed in all the tabs. To clear all your filters, click Clear All. To clear filters for a particular category, click the Clear button in that category. You can use the Search box in each of the filter criteria to search for content in that particular filter criterion.

On the listing page you can filter content based on the following:

  • Content Type: Filter the content based on the type of content you want to view, by selecting the required options from the listed content types. Currently, you can choose from Connectors, Solution Packs, and Widgets.
  • Category: Filter the content based on the categorization of the content. Examples of categories are Analytics and SIEM, Case Management, Endpoint Security, etc.
  • Publisher: Filter the content based on who is the publisher of the content. Content can be developed and published by Fortinet or Community (anonymous) or by various contributors such as Bay Dynamic, Eclecticiq, etc.

Clicking on a card on the Categories Listing page displays the detailed page for that content. For example, clicking on the Service Now connector card opens a page containing a brief introduction about the connector, its version, certification (certified or not), publisher information, the release highlights for that particular version of the connector and link to the connector documentation. It also contains a drop-down list of the previous versions for that connector. Clicking on a previous version opens a page containing information for that version of the connector:
Content Hub portal page - Connector Details

Similarly, clicking on a card in the Latest Updates section on the Content Hub page displays the detailed page for that content. For example, clicking on the Brute Force Attack Response solution pack card (or clicking the Learn More button) opens a page containing a brief introduction about the solution pack, and links to various reference information for that solution pack. It also contains a link to the GitHub repository (if the solution pack is on a public GitHub repo) for that solution pack and a Version drop-down list of previously available versions for that solution pack. Clicking on a previous version opens a new page containing information for that version of the solution pack:
Content Hub Portal page - Solution Pack details

You can also experience the Content Hub portal on your mobile and with the same pages, listings, and details as is present in a browser

Troubleshooting Tips

Unable to see updates for your entities in Content Hub

If you are unable to see updates for your entities such as connectors, widgets, etc. in Content Hub, it could be because the Content Hub data is not synced with the FortiSOAR repository.

Resolution

To resolve this issue, you can wait for the next synchronization cycle between Content Hub and the FortiSOAR repository. The Content Hub data gets synchronized from the FortiSOAR repository, currently, at the thirtieth minute of every hour (for example, 1:30, 2:30).

Or, you can manually force the synchronization using the following command:
sudo -u nginx php /opt/cyops-api/bin/console app:contenthub:sync --force