|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/fortisoar-engineers-guide-for-deployment-and-configuration/
课程评论：没有评论
课程名称：FortiSOAR- 工程师的部署和配置指南 课程概述： 成功的FortiSOAR实施始于对其部署架构的理解，可靠连接器的设置和可操作的剧本设计。 部署架构： FortiSOAR支持多种部署模型，适应不同的组织需求： - 独立模式：适合小型安全运维中心（SOC）或实验室，所有服务运行在单个节点上。 - 高可用性（HA）：采用活动/被动或活动/活动的配置，提供冗余和弹性。 - 集群模式：通过在多个节点上分配服务来横向扩展，理想用于托管安全服务提供商（MSSP）或大型企业SOC。 在部署之前，确保系统配置与您的日志量、案件负载和集成范围相匹配。FortiSOAR在Red Hat Enterprise Linux（RHEL）或CentOS上运行最佳，安装时的先决条件包括Python 3.6以上、PostgreSQL和配置好的Docker。 连接器配置： 连接器将FortiSOAR与外部系统（如SIEM、火墙、EDR和CTI平台）集成。可以通过用户界面中的设置→连接器进行部署，根据需要提供API端点、凭证和自定义参数。每个连接器支持特定的协议（例如REST、syslog、SMTP）。配置完成后，请始终运行测试连接以验证集成。对于不受支持的工具，FortiSOAR提供基于Python的连接器开发工具包（CDK）以创建自定义连接器。使用专用、最少权限的服务帐户，并将机密安全地存储在FortiSOAR保管库中。 剧本开发： 剧本通过基于触发器、条件和逻辑链接操作来自动处理事件。FortiSOAR的可视化剧本编辑器使工程师能够： - 在警报接收或用户操作时触发工作流程。 - 包含分支、循环、延迟和错误处理。 - 利用连接器的现成操作或使用Python或JavaScript的自定义脚本。 模块化的剧本设计提高了重用性和可扩展性。始终在测试环境中测试剧本，并包括回滚或异常路径。 总之，架构、连接器和剧本共同构成了FortiSOAR的操作基础，驱动您环境中的智能自动化安全响应。
Core Components of FortiSOAR Deployment: Architecture, Connectors, and PlaybooksA successful FortiSOAR implementation begins with understanding its deployment architecture, setting up reliable connectors, and designing actionable playbooks.Deployment ArchitectureFortiSOAR supports various deployment models based on organizational needs:Standalone: Suitable for small SOCs or labs, running all services on a single node.High Availability (HA): Uses an active/passive or active/active setup for redundancy and resilience.Clustered: Scales horizontally by distributing services across multiple nodes-ideal for MSSPs or large enterprise SOCs.Before deployment, ensure system sizing matches your log volume, case load, and integration scope. FortiSOAR runs best on Red Hat Enterprise Linux (RHEL) or CentOS, with prerequisites like Python 3.6+, PostgreSQL, and Docker configured during installation.Connector ConfigurationConnectors integrate FortiSOAR with external systems like SIEMs, firewalls, EDR, and CTI platforms. You can deploy them via the UI under Settings → Connectors, supplying API endpoints, credentials, and custom parameters as needed.Each connector supports a specific protocol (e.g., REST, syslog, SMTP). After configuration, always run Test Connection to validate integration. For unsupported tools, FortiSOAR provides a Python-based Connector Development Kit (CDK) to build custom connectors.Use dedicated, least-privilege service accounts and store secrets securely in the FortiSOAR vault.Playbook DevelopmentPlaybooks automate incident handling by chaining actions based on triggers, conditions, and logic. FortiSOAR's visual playbook editor allows engineers to:Trigger workflows on alert ingestion or user actions.Include branching, loops, delays, and error handling.Leverage out-of-the-box actions from connectors or custom scripts in Python or JavaScript.Modular playbook design improves reusability and scalability. Always test playbooks in staging and include rollback or exception paths.Together, architecture, connectors, and playbooks form the operational backbone of FortiSOAR, driving intelligent, automated security response across your environment.
