User Guide

• Get Started with FortiSOAR
  • Feature Tour
    • Working in FortiSOAR
    • Navigation
    • Searching
    • Viewing Settings and Executed Playbook Logs
    • Viewing Notifications and Pending Tasks
    • Adding Records
    • Editing Records
    • Modules & Models
    • Linking
      • Operational Links
      • Contextual Links
    • Automation
    • Access Control
    • Live UI - Web Sockets
• Manage User Access and Profiles
  • FortiSOAR Access: Login and Password Regeneration
  • User Profile
• Build and Customize Dashboards, Templates, and Widgets
  • Working with Dashboards
    • For Non-Admin Users
    • For Administrators
    • Permissions Required For Creating or Modifying dashboards
    • High-Level Process of Creating or Editing Dashboards
    • Non-Admin Users: Working with dashboards
      • Customizing your Home page
      • Customizing your Dashboards
      • Using Dashboards
    • Administrators: Working with Dashboards
      • Assigning Dashboards to Roles
    • Input Variables in Dashboards and Reports
      • Defining Input Variables
      • Configuring Input Variables
      • Using Input Variables
      • Related Records Filter in Widgets
  • Working with Templates
    • Editing Templates
      • Template Editing Mode
    • Template Types
      • Dashboard
      • Modules
  • Working with Template Widgets
    • Widget Settings
      • Configuring Conditional Visibility for Widgets in the View Panel
      • Configuring Conditional Visibility for Widgets in Dashboards, Reports, and across elements in FortiSOAR
    • Structure and Navigation
      • Rows
      • Tabs
    • Visualization and Monitoring
      • Chart
      • Relationship Count
      • Performance Metrics
      • System Monitoring
      • Connector Health
    • Record Management in List View
      • Card List
      • Card Count
      • Single Line Item
      • Simple Grid
      • Grid
      • Summary
    • Record Management in Detail View
      • Editable Form and Editable Form Group
      • Uncategorized Fields
    • Header Widgets
      • Primary Detail
    • Record Type
    • Related Record Listing
      • Relationships
      • Relationships Single Line Card
    • Utility Widgets
      • Comments
      • Visual Correlation
      • File Upload
      • Timeline
      • Executed Playbooks
      • Recommendation Settings
    • Custom Content
      • iFrame
      • Richtext Content
    • Common Components within Widgets
      • Default Sort
      • Nested Filters
    • Display Elements
      • All Inline or Inline Editor
      • Read-Only
      • Container
      • Insert Row Above
    • Displaying "Text Area" fields in the JSON format
• Work with Predefined and Advanced Modules
  • Default Modules
    • Dashboard
    • Queue & Shift Management
    • Incident Response
    • Automation
    • Schedules
    • Resources
    • Reports
    • Widget Library
    • Content Hub
    • Help
  • Advanced Modules
    • Vulnerability Management
    • SLA Management
    • Threat Intelligence Management
    • Hunts
    • Threat Intel Feed
• Customize Modules and Data Views
  • Creating and Editing Modules
    • Creating a New Module
    • Modifying Existing Modules
      • Display Template
      • Saving Changes
      • Viewing Changes
      • Publishing Modules
  • Configuring Picklists and Visual Correlation Settings
    • Creating or Modifying a Picklist
    • Configuring the Visual Correlation Widget
  • Working with System View Templates
    • Adding or Editing System View Templates
    • Best Practices for Working with System View Templates (SVTs)
  • Working with List Views
    • Designing Form View Templates: Best Practices and Field Loading Behavior
      • Field Loading Behavior in Form View Templates
    • Managing Templates, Data Views, and Record Handling
    • Searching and Filtering Alerts
    • Exporting Records from the List view
    • Editing a record in the List view
    • Executing Default Actions on Records in Bulk
    • Executing Playbook Actions on a Record
      • Using Row Expansion in Grids
  • Working with Detail Views
    • Alert Detail View: User Actions and Options
    • Tabs in the Alert Detail View
    • Editing a Complete Record
    • Editing a Record in the Alert Details Tab
      • Editing Record Fields
      • Viewing Breadcrumbs
      • Working with Related Records
    • Invoking Connector Actions directly on a Record
    • Identifying Similar Records Based on Defined Criteria
    • Auto-Suggesting Field Values from Existing Records
    • Displaying Suggested Playbooks for Record Processing
    • Viewing Phishing Classifications Suggestions
• Access and Install Content from the Content Hub
  • Permissions Required
  • Using the Content Hub
    • Discover Tab
    • Manage Tab
    • Create Tab
  • Content Hub Portal
  • Troubleshooting Tips
    • Unable to View Entity Updates in Content Hub
• Install and Manage Solution Packs
  • Permissions Required
  • Viewing Solution Packs in Content Hub
  • Working with Solution Packs
  • Creating Solution Packs
    • Launching a Widget from the FortiSOAR UI
  • Editing an existing Solution Pack
• Create and Use Widgets
  • Permissions Required
  • Viewing Widgets
  • Working with Widgets
  • Editing an existing widget
  • Creating Widgets
    • Directory Structure and Contents of Widgets
    • Configure a Widget Button that Triggers Manual or Reference Playbooks
  • Using the Code Editor: IntelliSense and File Management
    • File Management Operations
    • IntelliSense Features in the Code Editor
  • Using Widgets in FortiSOAR pages
• Search, Filter, and Analyze Data
  • Searching in FortiSOAR
    • Global Search
      • Keyword Search
      • Search Types and Search Results
      • Authorization
      • Searching Record Contents
    • List Search
      • Keyword Search
      • Filter Search
      • Search Results
    • FortiSOAR Search Errors
  • Filtering Records
    • Simple Filters
    • Advanced Filters
• Use Advanced FortiSOAR Features
  • Threat Intelligence Capabilities
    • Outbreak Management
    • Threat Intelligence Management
      • Vulnerability Management
  • Queue, Shift, and Leave Management
    • Prerequisites for Assignment Automation
    • Queue Management
      • Creating Queues
        • Permissions Required
        • Defining Queues
        • Queue Management Settings
      • Working with Queues
    • Shift Management
      • Permissions Required
      • Generating Shifts
      • Deleting Shifts in Bulk
      • Initiating Shift Handovers
    • Leave Management
      • Permissions Required
      • Adding Leaves
      • Editing, Exporting, Cloning, or Deleting Leaves
  • Reports in FortiSOAR
    • Permissions Required
    • Working with Reports
      • Importing a Report Template
      • Adding or Editing Reports on the Library page
      • Report Page Operations
      • Input Variables in Dashboards and Reports
      • Displaying Timezone in Exported Reports
      • Scheduling Reports
      • Historical Reports
  • Schedules
    • Permissions Required
    • Working with Schedules
  • War Room
    • Permissions Required
    • Launching a War Room
    • Setting up a War Room
      • Dashboard
      • Gathering a Response Team
      • Workspace - Enabling Communication
      • Task Management
      • Investigate
      • Communication
      • Timeline
• Tutorial: Create a Phishing Incident Form
  • Purpose
  • Configuring Required Fields for Phishing Incidents
  • Publishing the Incidents Module
  • Customizing Incident Module Detail View Templates
  • Conclusion
• Change Log