AI overview

The FortiAI service included with FortiSOC provides the following capabilities:

• Case impact analysis, including suggested next steps for a SOC action plan

• Threat summaries, including insights for high-risk cases, alerts, and assets

• Threat investigation support using an AI investigation agent

FortiAI is powered by the Fortinet FortiAI connector, which comes preconfigured for your FortiSOC instance. This FortiAI proxy is a secure intermediary that routes chat completion API requests through a controlled layer instead of sending them directly to the LLM provider.

This connector includes the following actions:

Action	Description
Chat Completion	Chat Completions is an API endpoint that allows applications to interact with AI models using a conversation format (messages with roles like system, user, and assistant). It is used to generate responses, answer questions, automate tasks.
Create Response	Create an new AI response using the Responses API.
Get Token Balance Details	Retrieves the token balance details, including entitled tokens, top-up tokens, account tokens, and their respective remaining balances.

FortiAI is used in the following playbooks, which can be found in Automation > Playbooks within the Fortinet FortiAI playbook collection:

Playbook	Description
FortiAI - Case Impact Assessments	This playbook leverages AI to automatically evaluate the potential business impact of a security incident, providing analysts with a prioritized risk score and context to focus on the most critical threats first.
FortiAI - Case Extraction	AI-powered case data extraction from security alerts for automated triage and response.
FortiAI - Case Enrichment & Impact Analysis	Extract information from cases and assess its impact.
FortiAI - Case Enrichment & Impact Analysis (On Update)	Extract information from cases (on update) and assess its impact.
FortiAI - Case Autonomously Remediation Demo	A demonstration playbook showcasing FortiAI's ability to autonomously investigate and remediate common security cases, providing a hands-on view of fully automated threat resolution from detection to containment.
FortiAI - Asset Threat Posture Timeline	Automatically generates a chronological timeline of security events and posture changes for a specific asset, giving analysts a clear, visual of its exposure to threats and the evolution of its security state.

To leverage AI within FortiSOC, SOC analysts can:

• execute FortiAI playbooks where relevant in the FortiSOC platform, such as within Cases or Case details. See FortiAI case enrichment.

• open the FortiAI Insight pane to view a threat summary of cases, alerts, and assets. See FortiAI Insight.

• prompt the FortiAI Investigation Agent for threat investigation support. See FortiAI Investigation Agent.