FortiSOAR: SOAR Orchestration and Response | Securevalley

July 2, 2026 · Nouh Droussi · Fortinet · Maroc · 4 min read · Updated September 26, 2026

FortiSOAR orchestrates your security tools and automates incident response through playbooks. How it works, its 2026 status and best practices.

FortiSOAR is Fortinet's platform for security orchestration, automation and response (SOAR). It centralizes the alerts generated by your tools, enriches them, and then runs playbooks that automatically chain together analysis and remediation actions. The goal is to reduce the repetitive work carried out by analysts and to make the response both faster and more consistent across the team.

What a SOAR does in a SOC

A security operations center receives, every day, a volume of alerts that teams cannot handle manually with the same level of rigor. The SIEM detects and correlates events; the SOAR then takes over to organize the handling of those alerts. It addresses three needs:

• orchestration: enabling heterogeneous tools (firewalls, EDR, email, directory services, threat intelligence sources) to work together through their APIs;
• automation: executing low-value tasks without human intervention, such as enriching an IP address or checking a file hash;
• incident management: tracking each case from creation to closure, with a history that can be used for audit purposes.

The functional building blocks of FortiSOAR

The platform relies on a few components that every administrator needs to master:

• connectors: Fortinet states that more than 700 API integrations are available, covering its own products and many third-party vendors;
• playbooks: visual workflows made up of triggers, conditions, loops and actions; they can be fully automated or include human approval steps;
• modules and case management: alerts, incidents, indicators and tasks are structured records, with role-based access control;
• solution packs: ready-to-use bundles (incident management, vulnerability management, compliance, network operations) that you then adapt to your own context;
• multi-tenant mode, designed for MSSPs that manage several customers from a single instance.

FortiSOAR is available as self-hosted software (virtual appliance) or as SaaS.

Product status in 2026

FortiSOAR has been neither renamed nor discontinued: it is an active product, and its 8.0 branch is published in the Fortinet documentation library. This release focuses on AI agents that assist with alert investigation and playbook building, with the option of choosing the language model used. For more modest needs, note that FortiAnalyzer also includes playbook-based automation features; FortiSOAR remains the reference tool as soon as you need to orchestrate many third-party tools or several teams.

Designing useful playbooks

The value of a SOAR depends less on the tool itself than on the quality of the processes you translate into it. A few proven principles:

• start from existing procedures: a playbook automates a procedure that has already been defined; if there is no procedure, there is nothing reliable to automate;
• begin with enrichment: reputation of an IP address, domain or file, user lookup in the directory, asset context; these actions carry no risk for production;
• keep a human in the loop for high-impact actions: isolating a workstation, blocking an account or modifying a firewall rule should first go through explicit approval;
• version and test: a playbook is tested on demonstration data before it goes live, and every change is documented;
• handle failures: define what should happen if an API does not respond or returns an error.

A classic use case is the handling of phishing reports: extraction of attachments and URLs, reputation analysis, search for other recipients of the same message, and then deletion from mailboxes after the analyst has approved the action.

Measuring the benefits of automation

To check that the investment is delivering results, track a few simple indicators: mean time to acknowledge an alert, mean time to resolution, the share of alerts closed automatically, and the rate of false positives escalated to analysts. Compare these values before and after each playbook is deployed. This measurement also helps you decide which processes should be automated next.

Skills and training

Administering FortiSOAR requires three sets of skills: knowledge of incident response processes, an understanding of how a SOC operates, and technical comfort with APIs, the JSON format and some Python scripting. Several learning paths are relevant for building these foundations:

• Certified SOC Analyst (CSA) for SOC operations, alert triage and correlation;
• EC-Council Certified Incident Handler (ECIH) for the stages of incident handling, which then become the steps of your playbooks;
• ISO/IEC 27035 Lead Incident Manager for structuring the incident management process across the organization.

Conclusion

FortiSOAR provides a tool-based answer to SOC overload, provided it is fed with clear and tested processes. Start by automating enrichment, measure the gains, and then gradually extend automation to remediation actions, keeping human control wherever the impact is significant.