Over two days, SOC analysts learn to work with FortiAnalyzer 7.6 in real operations: navigating logs, handling events and incidents, hunting threats, automating responses with playbooks and building reports. More than half of the course time is spent in hands-on labs. It prepares you for the Fortinet NSE 5 – FortiAnalyzer 7.6 Analyst exam in the Security Operations track. It suits analysts who want to turn raw FortiGate logs into actionable detections.
Position FortiAnalyzer within a SOC and the Security Fabric
Trace log data flow and move efficiently through FortiView dashboards
Configure event handlers and triage indicators and incidents
Run threat hunts and review outbreak alerts with help from FortiAI
Automate response actions with playbooks
Build reports, charts and datasets that fit your needs
Troubleshoot common collection and analytics issues
Program
SOC concepts and Security Fabric
What a SOC does
FortiAnalyzer in the Security Fabric
Log data flow and navigation
Collection and parsing
Searching and filtering
FortiView dashboards
Events, indicators and incidents
Event handlers
Indicators of compromise
Incident lifecycle
FortiAI, threat hunting and troubleshooting
FortiAI assistance
Outbreak reports
Troubleshooting methods
Reports
Templates, charts and datasets
SQL SELECT queries
Playbooks
Triggers and actions
Automation connectors
Monitoring playbook runs
Prerequisites
FortiGate Operator and FortiAnalyzer Administrator courses, or equivalent experience
Basic SQL SELECT syntax (recommended)
For the exam, Fortinet recommends 6 to 12 months of hands-on FortiGate and FortiAnalyzer experience
Target audience
Tier 1 and tier 2 SOC analysts
Security engineers handling analytics and incident response
MSSP teams running FortiAnalyzer for their customers
The exam
The Fortinet NSE 5 – FortiAnalyzer 7.6 Analyst exam has 30 to 35 questions to answer in 65 minutes. It is available in English and Japanese and is scored pass/fail, with the score report available in your Pearson VUE account, since Pearson VUE delivers the exam. Topics cover features and Fabric integration, log analysis and FortiView, SOC operations and automation, and reports and datasets. The resulting NSE certification is valid for two years; you must recertify before it expires, as expiry dates cannot be extended.
Preparation tips
Rebuild each lab playbook with different triggers and actions
Write a few SQL SELECT queries against datasets yourself
Time yourself: roughly two minutes per question on exam day
Frequently asked questions (FAQ)
Does the “FortiAnalyzer SOC Operator” course still exist?
Fortinet's current title is FortiAnalyzer 7.6 Analyst. That SOC-focused course is the one described on this page; we kept the former address so it stays easy to find.
Which NSE level does this course target?
It prepares for the NSE 5 – FortiAnalyzer 7.6 Analyst exam, in the Security Operations track of the eight-level NSE program that took effect on 15 July 2026.
Do I need FortiAnalyzer Administrator first?
Fortinet recommends it, along with FortiGate Operator. If you already run FortiAnalyzer day to day, a quick call with our team can confirm whether you can go straight to the Analyst course.
Is the exam available in French?
No. Fortinet offers it in English and Japanese. The course itself can be taught in French or English.
What delivery formats are available?
Live online, in person in Casablanca, or a private session on-site at your organization, with a lab environment per participant to practice every scenario.