Upgrade Information
You can upgrade your FortiSOAR enterprise instance, High Availability (HA) cluster, or a distributed multi-tenant configuration to release 7.6.6 using the following guidance.
The FortiSOAR UI displays a notification when a new General Availability (GA) release is available. The notification includes a direct link to the release notes for more details.
Before You Upgrade
The upgrade process will temporarily take your FortiSOAR application offline. During this time, users will not be able to access or log in to the platform.
To ensure a smooth upgrade:
- Notify users: Inform all users in advance about the planned maintenance window and expected downtime.
- Stop active processes: Confirm that no critical playbooks, automations, or integrations are running before starting the upgrade.
- Back up your system: Perform backup of the FortiSOAR database and configuration to prevent data loss in case of unexpected issues.
- Confirm prerequisites: Verify that your environment meets all system requirements (OS version, disk space, dependencies, etc.).
Downgrading to previous firmware versions
Downgrading to previous firmware versions is not supported.
Upgrade Path
The following table provides version compatibility between FortiSOAR components and the supported upgrade paths:
| Enterprise or MSSP Master Node | Supported Upgrade | Compatible Tenant Node | Compatible Agent | Compatible Secure Message Exchange (SME) |
|---|---|---|---|---|
| 7.6.6 (c) | 7.6.5-7.6.0 7.5.3 -7.5.0 |
7.6.5 -7.6.0 Important: Since release 7.6.6 is mainly to get the updated CA certificates from the FortiGuard Distribution Network (FDN) to ensure ongoing secure communication and stable license synchronization, it is not necessary nor recommended to upgrade the external SME. |
||
|
7.6.5 (c) |
7.6.4-7.6.0 |
7.6.4 -7.6.0 |
||
| 7.6.4 (c) | 7.6.3-7.6.0 7.5.2-7.5.0 |
7.6.4 -7.6.0 Note:Upgrade-only releases, such as 7.6.3 and 7.5.2, do not support upgrading external SMEs to these versions. |
||
| 7.6.3 (5) (c) (upgrade-only release) |
7.6.2-7.5.0 | 7.6.3 -7.6.0, 7.5.2-7.5.0 |
7.6.2 -7.6.0, 7.5.1-7.5.0 |
|
| 7.6.2 (b) (c) | 7.6.1-7.5.0 | 7.6.2-7.6.0 | ||
| 7.6.1 | 7.6.0-7.5.0 | 7.6.1, 7.6.0 | ||
| 7.6.0 | 7.5.2-7.5.0 | 7.6.0, 7.5.0 | ||
|
7.5.3 |
7.5.2-7.5.0 |
7.5.3-7.5.0 |
||
| 7.5.2 (5) (upgrade-only release) |
7.5.0, 7.5.1 | 7.5.2-7.5.0 | 7.5.1, 7.5.0 | |
| 7.5.1 (upgrade-only release) |
7.5.0 | 7.5.1, 7.5.0, 7.4.5 -7.4.0 |
||
| 7.5.0 | 7.4.5- 7.4.0 | 7.5.0, 7.4.5-7.4.0 |
||
| 7.4.5 (4) (upgrade-only release) |
7.4.4, 7.4.3 | 7.4.5-7.4.0 | ||
| 7.4.4 (4) (upgrade-only release) |
7.4.3-7.4.0 | 7.4.4-7.4.0 | ||
| 7.4.3 (a) (4) (upgrade-only release) |
7.4.2-7.4.0 | 7.4.3-7.4.0 | ||
| 7.4.2 (4) | 7.4.1, 7.4.0 | 7.4.2-7.4.0 | ||
| 7.4.1 (3) | 7.4.0 | 7.4.1, 7.4.0, 7.3.2 |
||
| 7.4.0 | 7.3.3-7.3.0 | 7.4.0, 7.3.2 |
||
| 7.3.3 (2) (upgrade-only release) |
7.3.2, 7.3.1 | 7.3.3-7.3.1 | ||
| 7.3.2 (2) (upgrade-only release) |
7.3.1, 7.3.0 | 7.3.2-7.3.0 | ||
| 7.3.1 (1) | 7.3.0 | 7.3.1, 7.3.0 | ||
| 7.3.0 (for upgrade and migration support) |
7.2.2, 7.2.1 | 7.3.0 | ||
|
Upgrade Notes:
|
||||
Compatibility Notes:
(1) No incompatibility issues were observed in MSSP use cases; however, the 'Manual Input' step operates differently in systems that have a lower-version tenant node and a higher-version master node since, FortiSOAR release 7.3.1 has an enhanced UI and upgraded functionality.
(2) No incompatibility issues were observed in MSSP use cases; however, in FortiSOAR release 7.3.1, the 'Complete' playbook environment can be passed to child playbooks, which was not possible in earlier versions, leading to some differences in systems that have a lower-version tenant node and a higher-version master node.
(3) Pushing approval playbooks from FortiSOAR release 7.4.1 master node to a lower-version tenant node is not supported. In such cases, the playbook is not visible on the tenant node, and neither will FortiSOAR display any error.
(4) No incompatibility issues were observed between versions 7.4.2, 7.4.3, and 7.4.4 of the FortiSOAR enterprise/MSSP-master and FSR agent, Secure Message Exchange (SME), or MSSP-tenants.
However, it is important to consider the following when using versions 7.4.2, 7.4.3, or 7.4.4 of the FortiSOAR enterprise/MSSP-master with 7.4.0 or 7.4.1 versions of FSR agent or MSSP-tenants:
In the case of MSSP environments, it is recommended that you upgrade both the master and tenant nodes to release 7.4.4 or 7.4.3. If your master and tenant nodes are both not upgraded to release 7.4.4 or 7.4.3, take note of the following:
- Ensure that you synchronize records along with their relationships when you use the 'Sync Records' feature, if your master node is on release 7.4.2 or later, and your tenant nodes are on release earlier than 7.4.2, such as 7.4.1 or 7.4.0.
- To download 'FSR Agent/Tenant node' logs, both the master and agent/tenant must be on release 7.4.2 or later. If the master node is on release 7.4.2 or later, and the agent is on a release earlier than 7.4.2, the log download is unsuccessful and returns an error such as
"For agents, log collection is accessible on version 7.4.2 and beyond". - Replication from a tenant node that is on release 7.4.1 or 7.4.0 to a master node that is on release 7.4.2 or later will not fail if related records are not present on the master node. However, in the same case, replication from the master node to tenant nodes will fail if related records are not present on the tenant node.
- The update record request fails when the record is unavailable at the replicated end when a tenant node is on release 7.4.1 or 7.4.0, and the master node is on release 7.4.2 or later.
(5) Releases 7.5.2 and 7.6.3 are upgrade-only releases and upgrading an external FortiSOAR SME to both these releases are not supported.
Upgrade Procedure
Review and respond to all upgrade prompts carefully. If the root password reset is skipped, it must be reset later from the VM console. Refer to the Red Hat or Rocky Linux documentation for instructions.
The upgrade process for FortiSOAR enterprise systems is as follows:
- Connect to the FortiSOAR VM via SSH and start a
tmuxsession. - Run the following command to check if your system is ready for an upgrade to release 7.6.6 :
sudo csadm upgrade check-readiness --target-version 7.6.6 - (Optional) Resolve any validation failures and rerun the check to confirm readiness.
Important: Run the readiness check before upgrading to ensure success. - Run the following command to upgrade your system to release 7.6.6:
sudo csadm upgrade execute --target-version 7.6.6
Note: The system’s appliance host key changes during the upgrade.
For detailed procedures, including preparation steps and instructions for High Availability setups, multi-tenancy environments, and Docker deployments, see the Upgrade Guide.
After the Upgrade
Once the upgrade is complete, perform these checks to ensure system stability and optimal performance:
- Clear browser cache: Clear your cache and log out before signing back in to avoid any UI or functionality issues.
- Verify key functions: Review key system areas such as playbook audit logs, user access, and automation services.
- Validate integrations: Confirm that all connectors, integrations, and scheduled jobs are working properly.
- Monitor performance: Observe system health metrics and logs for any irregular behavior in the hours following the upgrade.