Administrators can collect and review FortiSOAR logs for troubleshooting in two primary ways. First, they can download logs directly from the GUI, which provides access to various logs through an intuitive interface. Secondly, using the command-line interface, the csacta log --collect command can be used to gather all logs within a specified directory, enabling more detailed offline analysis. Both methods offer comprehensive log collection to aid in diagnosing and resolving issues​.

In a FortiSOAR High Availability (HA) cluster setup with an externalized PostgreSQL database, it is necessary to configure the database server to allow incoming connections from all FortiSOAR nodes. This configuration involves modifying the pg_hba.conf file to set up host-based authentication and control which IP addresses can connect. The postgresql.conf file must also be adjusted to enable listening on all necessary IP addresses, which is critical for FortiSOAR nodes to connect to the database server securely and reliably. Together, these configurations ensure that all FortiSOAR nodes can access the database, facilitating effective HA functionality​.

In FortiSOAR's War Room, users can perform several actions to manage incidents effectively. They can view a graphical representation of records linked to an incident in the Artifacts lab, which helps visualize connections and dependencies. Additionally, the War Room supports tagging investigation results as evidence, allowing for a structured approach to incident documentation. Users can also manage tasks via the Task Manager tab, facilitating task creation, assignment, and tracking within the incident response workflow​.

In FortiSOAR, when a user is configured with "Concurrent" access type, their ability to log in depends on the availability of concurrent user seats. This means the user can only log in if there are available seats in the concurrent pool. If all seats are occupied, the user must wait until a seat becomes free. This configuration allows multiple users to share a pool of licenses, making it suitable for environments where not all users need constant access​.

The FortiSOAR perpetual trial license includes limitations on both the number of users and the number of actions that can be performed. These restrictions are in place to provide prospective users with a functional evaluation of FortiSOAR while limiting its usage in a production environment. The trial license does not support multi-tenancy and restricts the overall capacity for scaling, making it suitable only for testing and familiarization with FortiSOAR’s capabilities​.

In FortiSOAR, the service responsible for the playbook scheduling functionality is colcrybeatd. This service manages the timing and execution of scheduled playbooks, allowing for the automation of various tasks at specified intervals. It ensures that playbooks execute according to their configured schedules, which can include tasks such as data ingestion, threat detection, or incident response actions. Proper functioning of this service is essential for the reliable automation of time-dependent processes within FortiSOAR​.

Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:

FortiSOAR comes with several pre-defined (out-of-the-box) roles designed to align with common Security Operations Center (SOC) functions. According to the FortiSOAR 7.3 Administration Guide under the "Security Management" section:

T1 Analyst (Tier 1): This role is a default configuration intended for front-line analysts who perform initial triaging of alerts and basic incident response tasks.

Connector Administrator: This is a specialized default role that grants permissions specifically for configuring, updating, and managing the lifecycle of connectors within the environment.

While FortiSOAR is highly customizable and allows for the creation of T2 or T3 roles, they are not always present as specific "default" named roles in the same way the T1 Analyst is across all base installations. Furthermore, "FortiSOAR Agent" refers to a technical component or a deployment architecture rather than a standard user RBAC (Role-Based Access Control) role. Other common default roles include Security Administrator , Application Administrator , and Full Access .

Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:

According to the FortiSOAR 7.3 Deployment and Administration Guide under the "Licensing FortiSOAR" section:

Connectivity Requirements: For the FortiSOAR license deployment and validation process to succeed, the instance must have outbound connectivity to https://globalupdate.fortinet.net . This URL is specifically used by the FortiSOAR license manager to fetch entitlements, verify the subscription status, and retrieve product information from the Fortinet licensing servers. If this connectivity is blocked (and a FortiManager is not being used as a local FDN proxy), the license deployment will fail. 4

License Limits: Every FortiSOAR license—whether Perpetual, Subscription, or Trial—strictly enforces a maximum number of active users (concurrent or named) and often a limit on the number of automation actions per day. 5

Perpetual Trial Licenses (often called "Free Trial") are restricted to a specific user count (typically 2 or 3) and a daily action limit (e.g., 200 or 1000 actions). Therefore, options C and D are incorrect as they suggest "no limit on user count."

URL Clarification: While update.fortiguard.net is a common Fortinet endpoint for security signatures (IPS/AV), FortiSOAR's specific licensing and entitlement communication is directed to the globalupdate.fortinet.net service.

In FortiSOAR, system-level logs that can be purged include both "Audit logs" and "Executed Playbook logs." These types of logs can be configured to be purged periodically to free up storage space and ensure that unnecessary logs do not impact system performance. The application configuration allows administrators to schedule automatic purges, which can be especially useful in high-activity environments where log data accumulates quickly. Purging these logs helps maintain a cleaner and more efficient system​.