Skip to main content
Training Institute
  • Library
  • Schedule
  • Certifications
  • ATC
  • Academic Partner Program
  • Fast Track Workshops
  • More
Log in
Contents
Library Schedule Certifications ATC Academic Partner Program Fast Track Workshops

FortiSOAR Analyst

Blocks

Certification

This exam is part of the following certification track:

Visit the Cybersecurity Certification page for information about certification requirements.

Exams available at Pearson VUE are listed below. Select an exam to view the details.

Fortinet NSE 6 - FortiSOAR 7.6 Analyst

Status: Available

The NSE 6 - FortiSOAR 7.6 Analyst exam evaluates your knowledge of, and expertise with, developing playbooks; creating modules, templates dashboards, and widgets; and performing incident handing with FortiSOAR.

Once you pass the exam, you will receive the following exam badge:

Audience

The NSE 6 - FortiSOAR 7.6 Analyst exam is intended for network and security professionals responsible for developing playbooks, creating modules, templates, dashboards, and widgets, and performing incident handling with FortiSOAR.

Exam Details
Exam name Fortinet NSE 6 - FortiSOAR 7.6 Analyst
Time allowed 60–70 minutes
Exam questions 35–45 questions
Scoring Pass or fail. A score report is available from your Pearson VUE account.
Language English
Product version FortiSOAR 7.6
Exam Topics

Successful candidates have applied knowledge and skills in the following areas and tasks:

FortiSOAR architecture and data models (20–30% of the exam)
Tasks Details
Identify FortiSOAR deployment models
  • Introduction to automation and orchestration
  • FortiSOAR system architecture
  • Interface navigation
  • Content Hub
  • SOAR and SIEM comparison
  • Automation and orchestration comparison
  • Different deployment models
Analyze how modules, records, fields, and relationships define the FortiSOAR data model
  • SME, agents, tenant nodes
  • Agent connectivity
  • Solution pack content
  • Use cases: picklist, module, and visual correlation
Implement access control
  • Access control
  • Users, roles, and teams
  • Team hierarchy
  • Record ownership and assignment comparison
  • FortiSOAR menu navigation
  • Use case: access control implementation
Configure templates, dashboards, and widgets
  • Use cases: FortiSOAR navigation, template configuration, dashboard configuration, and widgets
  • Use cases: View templates, and dashboard
Playbook Development (25–35% of the exam)
Tasks Details
Implement playbook logic
  • Playbook basics
  • Playbook steps
  • Playbook logic design
  • Data Ingestion
  • Preprocessing rules
  • Where conditions are used
  • If/elif/else logic, step conditions,and operators
  • Use cases: loops, for-each loops, loop variables, and step utility actions
Manipulate data using Jinja filters
  • Jinja introduction
  • JSON introduction
  • Dynamic variables
  • Dynamic values and functions
  • Basic Jinja filters
  • Use cases: Jinja filters
Analyze basic JSON Query and YAQL statements
  • JSON queries
  • YAQL queries
  • JSON query and YAQL comparison
  • Use cases
Incident Handling (5–15 of the exam)
Tasks Details
Manage FortiSOAR incident phases
  • FortiSOAR incidents
  • MITRE ATT&CK Framework
Create queues and shifts for workload management
  • Incident handling workflow
  • Queue and shift assignment
Use war rooms for incident handling
  • War rooms management
  • Use cases
Correlate records across modules
  • Link-related records
  • Visual correlation
  • Tactics and techniques
  • MITRE records
  • Incident phases mapping
APIs and Connectors (15–25% of the exam)
Tasks Details
Configure FortiSOAR connectors
  • REST API requests and responses
  • FortiSOAR API
  • FortiManager API
  • Custom connectors
Interact with FortiSOAR using the API or custom triggers
  • HTTP methods to CRUD
  • FortiSOAR REST API use
Compare REST API and JSON-RPC API
  • JSON-RPC basics
  • REST and JSON-RPC comparison
  • Connector build steps
Troubleshooting (15–25% of the exam)
Tasks Details
Identify common playbook and connector issues
  • Playbook logging level
  • Executed playbook logs
  • Step input/output
  • Evaluated arguments
Use the Jinja editor to troubleshoot Jinja expressions
  • Jinja expressions
  • Use cases
Debug and troubleshoot playbooks using executed playbook logs
  • Key log files
  • Service status
Training Resources

The following resources are recommended for attaining the knowledge and skills that are covered on the exam. The recommended training is available as a foundation for exam preparation. In addition to training, you are strongly encouraged to have hands-on experience with the exam topics and objectives.

  • FortiSOAR 7.6 Analyst course and hands-on labs
  • FortiSOAR 7.6—Administration Guide
  • FortiSOAR 7.6—User Guide
  • FortiSOAR 7.6—Playbooks Guide
  • FortiSOAR 7.6—Connectors Guide
Experience
  • Minimum of 6 months of practical experience with FortiSOAR playbook development; module, template, dashboard, and widgets creation; and performing incident handling.
Exam Sample Questions

A set of sample questions is available from the Fortinet Training Institute. These questions represent the exam content in question type and content scope. However, the questions do not necessarily represent all the exam content, nor are they intended to assess your readiness to take the certification exam.

See the Fortinet Training Institute for the course that includes the sample questions

Examination Policies and Procedures

The Fortinet Training Institute recommends that you review the exam policies and procedures before you register for the exam. Access important information on the Fortinet Training Institute Policies page, and find answers to common questions on the FAQ page.

Questions?

If you have more questions about the NSE Certification Program, contact us through the Fortinet Training Institute Helpdesk page.

Data retention summary