SECURITY ATLAS / EVALUATION BRIEF FortiSOAR Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/fortinet-fortisoar/ THE ATLAS TAKE FortiSOAR provides incident-oriented orchestration through playbooks and connectors to security and IT systems. It can operate across third-party tools, so an existing Fortinet environment is useful context rather than proof that every integration is already configured. Atlas analysis: evaluate it as a privileged response system. Role design, connector credentials, and remote-agent placement determine what an analyst or playbook can actually do. A successful enrichment action is a useful first step, but containment requires separate permission, target validation, failure handling, and an auditable approval policy. SCOPE Software the buyer or an MSSP staffs. Connector counts change over time. OT playbooks are a capability claim to test, not a plant-safety certification or sign-off. WORTH A LOOK WHEN SOCs requiring structured incident workflows and cross-tool playbooks with explicit administrative and execution roles. THINK TWICE WHEN The team assumes all integrations work in an isolated network without endpoint access or that every analyst should edit and execute playbooks. IMPLEMENTATION 1. Design narrow operational roles Separate connector administration, playbook authoring, and approved action execution. 2. Verify network and credential paths Test a supported third-party service from the actual platform or agent location. 3. Rehearse a bounded response Use a lab endpoint and preserve authorization, action result, and recovery evidence. OPERATING REALITY Connector versions, service credentials, role assignments, agents, and playbook dependencies need ongoing review. Atlas analysis: distinguish administration, authoring, and execution. A production workflow should be tested with the operator's real role and remote network path rather than an unrestricted administrator account that masks deployment problems. COMMERCIAL CONSIDERATIONS Confirm platform, agent, connector, deployment, and support scope against the expected incident and automation program. - Platform deployment and commercial entitlement - Remote-agent and integration infrastructure - Playbook development and role governance EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Verify execute permissions Acceptance evidence: Prove the intended operator can run an approved playbook but cannot edit roles or connectors. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Test remote execution Acceptance evidence: Record the selected agent, target service, delegated account, and successful lab action. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Handle a connector failure Acceptance evidence: Expire a lab token and verify visible failure without falsely reporting completed containment. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which OT detections are read-only, and who authorizes any process-impacting containment? - Does an MSSP tenant model match how you separate customers or plants? - How are playbooks and cases exported if FortiSOAR is later replaced, including MSSP tenant separation? EVIDENCE GAPS Public evidence limitation: Detailed release guides blocked direct retrieval, so connector, role, and remote-agent details were reviewed through indexed official excerpts. The current product page was accessible; installed-version settings and limits still require confirmation in the entitled release documentation before enabling response actions. - No independent role-isolation or connector-reliability assessment was performed. - Installed-version and agent compatibility need verification against the selected release. SOURCES FortiSOAR connectors (Documentation) https://docs.fortinet.com/document/fortisoar/7.6.5/connectors-guide/929681/introduction-to-connectors FortiSOAR roles (Documentation) https://docs.fortinet.com/document/fortisoar/latest/administration-guide/467614/roles FortiSOAR agent configuration (Documentation) https://docs.fortinet.com/document/fortisoar/7.6.5/administration-guide/204303/fortisoar-agent-setup-and-configuration FortiSOAR current product scope (Product information) https://www.fortinet.com/products/fortisoar Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.