About FortiSOAR

The left navigation panel contains a link that includes the version and build number of FortiSOAR that is installed in your environment. For example, in the following image, the version of FortiSOAR installed is 7.4.0, and the build number is 3024:

Clicking on the FortiSOAR Version Number-Build Number link displays the version information of the major components of FortiSOAR, which are: Application Engine, Playbook Engine, Integration Engine, Authentication Engine, and Client Interface.

You can use the information presented in the Version pop-up, in the following cases:

• If you require some issue resolution or feature enhancement, then you might need to know the exact version of FortiSOAR installed in your environment, since the fix or enhancement might vary based on the version.
• There can be instances where you require only a component, for example, the Client Interface, within FortiSOAR to be updated. In such cases, you might need to know the versions of all the components in your FortiSOAR system.

The 'Version' pop-up also displays notifications when a new Release (always the latest) and/or the latest Security Patch that is released for the version that is installed on your system is available. For example, if you have release 7.4.0 installed, then this dialog displays the following notifications:

• Availability of the latest release, which in the case of our example is 7.4.1.
• Availability of a new Security Patch on release 7.4.0, which in the case of our example is Security Patch 1. This notification always contains the latest Security Patch that is released for the version installed on your system, for example, if you had FortiSOAR release 7.2.2 installed on your system, then the notification would state Security Patch 7, as there are seven security patches released for FortiSOAR release 7.2.2.

The Release notification contains a Details link to that version's release notes so that users can get details about the latest available release. This keeps users informed about the latest releases and helps them in making informed decisions about upgrading to the latest available version. Similarly, the Security Patch notification also contains a Details link to the security patch documentation, using which users can get details about the latest security patch and make informed decisions on applying the security patch to their systems.

The FortiSOAR login page displays the number of the latest security patch (SP), if any SP is available for the FortiSOAR release installed on your system. For example, if you have FortiSOAR release 7.4.0 installed on your system, which has SP1 available, then the login page displays 7.4.0-3024 (SP1).

You can also view similar notifications when you click the Notifications icon on the top-right corner of the FortiSOAR screen. To view the upgrade notification, click the Notifications icon and look for the Updates tag:

To view the version's release notes, click the release notification row, and to view the security patch documentation, click the security patch notification row. To dismiss the notifications, click the Delete icon in the notification row.

Downloading FortiSOAR logs

The 'Version' pop-up also displays a Download Logs link using which you can collect logs directly from UI. Application logs are important and are often required to troubleshoot issues, and during upgrade and installation operations. Prior to release 7.0.0, log collection was only possible using CLI commands, and there could be some SOC environments where SSH access to systems are very restricted and required to go through various approvals. Therefore, in such cases, collecting logs would become a tedious task. To ease the process of log collection, you can directly collect logs from the Version pop-up and share them with support team for further troubleshooting.

Clicking the Download Logs link displays a Download Logs dialog that provides you with an option to either download the log files without a password or to password-protect the downloaded log files.

By default, the Yes option is selected, i.e., you must add a password to protect the downloaded log files, so that the log files get an added security and can be opened only by users who have the password and not by everyone who has access to the system. Clicking Yes opens the Download logs with password dialog where you can enter the password for the log files and then click Download. If you click No, download without password, then the process of collecting and downloading the logs starts immediately.

The following log files are downloaded:

/var/log/cyops 
/var/log/nginx 
/var/log/elasticsearch 
/var/log/messages* 
/var/log/audit 
/var/log/rabbitmq  
/var/log/php-fpm