FortiSOAR Expert & Security Automation Consultant
This is implementation experience, not presales slideware. I have built FortiSOAR in production: playbooks in the visual designer, connectors including custom ones written when nothing in the store fitted, case management with war rooms and SLA tracking, and the FortiSIEM integration that turns a detected incident into an actual response.
- Production implementation experience
- Playbook and custom connector development
- FortiSIEM and Security Fabric integration
What is FortiSOAR?
FortiSOAR is Fortinet's security orchestration, automation and response platform. The short description is that it takes alerts from wherever they originate, a SIEM, a mailbox, an EDR agent, a threat feed, and runs them through logic you designed rather than logic an analyst has to remember at three in the morning. Fortinet publishes figures of over 700 product integrations and roughly 6,500 prebuilt playbooks in the content library, alongside no-code and low-code playbook creation in a visual drag-and-drop designer.
Underneath the automation sits a proper data model, and this is the part buyers usually underestimate. FortiSOAR is built on modules, including Alerts, Incidents, Indicators, Assets, Tasks and War Rooms, each with fields, picklists, relationships and permissions you can modify. Playbooks operate on record sets from those modules, triggered manually, on record creation, on update, or by reference from another playbook. Around that sits case management: analysts work queues, escalate an alert into an incident, open a war room to collaborate on a live investigation with tasks and evidence in one place, and the platform measures response and resolution against SLA targets so team performance is reportable rather than anecdotal.
On current positioning: FortiSOAR still ships under that name and sits in the Fortinet Security Fabric next to FortiSIEM, FortiAnalyzer and FortiAI. In 2026 Fortinet launched FortiSOC, a unified cloud-delivered SOC platform that consolidates SIEM, SOAR and threat intelligence into a single service. Fortinet has been clear that FortiSOC is an additional offering for organisations that want that consolidation, that the existing individual SOC products continue to be enhanced and available, and that migration tooling is coming for customers who choose to move. So a FortiSOAR investment made today is not stranded, but it is a question worth raising at renewal.
Where I Can Help
The work that actually gets a FortiSOAR deployment into production and keeps it useful once the initial enthusiasm wears off.
Playbook Development & the Visual Designer
Building working playbooks in the drag-and-drop designer rather than importing the library and hoping. Triggers, decision branches, manual approval steps, loops over record sets, variables and Jinja expressions. Typical first builds are phishing triage from a reported mailbox and automated IOC enrichment with reputation scoring, because those return time to the analysts fastest.
Connectors, the Store & Custom Builds
Configuring and health-checking connectors from the content hub, then writing custom ones when nothing fits, which happens on most real projects. That means the connector SDK, defining operations and configuration parameters, handling authentication and pagination, and packaging it so it survives an upgrade. Also covers bidirectional ticket synchronisation with ITSM platforms such as ServiceNow and Jira.
Case Management, War Rooms & SLA
Setting up how the SOC actually works: alert queues and shift assignment, escalation from alert to incident, war rooms for live investigations with tasks and collaborators, and response and resolution SLA fields with the reporting that makes team performance visible. Done properly this is what your service level commitments are measured against, so it needs designing rather than defaulting.
Modules, Record Sets & Data Model Design
Shaping the module editor to match how your team categorises work: custom fields, picklists, relationships between alerts, incidents, indicators and assets, filters and dynamic record sets that feed dashboards and playbooks. Plus role-based access control at module and field level, which matters as soon as more than one team shares the platform.
Multi-Tenancy for MSSP Deployment
Designing dedicated or shared tenancy for a managed service, with a master node and tenant nodes, data forwarding rules controlling what moves upward, and remote playbook execution so actions run inside the customer network. Includes tenant onboarding that is repeatable instead of hand-built each time, and the access model that keeps one customer from seeing another.
FortiSIEM Integration & Fabric Response
Wiring FortiSIEM incidents into FortiSOAR alerts with the field mapping and deduplication that stops one incident becoming forty records, then closing the loop through the Security Fabric: banning an address on FortiGate, isolating a host through the endpoint agent, disabling an account in Entra ID or Active Directory, and notifying the owner before the containment lands.
Why FortiSOAR for UAE Organisations?
UAE regulation increasingly asks not just whether you detected something but how quickly you responded. NESA expects a defined and exercised incident response capability with evidence that incidents are handled and closed. The CBUAE requirements push licensed financial institutions towards continuous monitoring and demonstrable response, and DESC applies similar expectations to Dubai government-linked entities. ADGM, DIFC and the federal PDPL add breach notification timelines. A SOAR platform is how those timelines stop depending on whoever happens to be on shift, because the enrichment, the notification and the containment steps run the same way every time and leave an audit trail behind them.
The use cases that pay for themselves in a regional SOC are unglamorous and repeatable. Phishing triage is the obvious first one: a user reports a message, the playbook extracts URLs and attachments, detonates or checks reputation, decides, and where it is malicious pulls the same message from every other mailbox and tells the reporter what happened. IOC enrichment across threat intelligence sources removes the copy-and-paste loop between five browser tabs. Containment playbooks handle user and host response, blocking an address on the firewall, isolating an endpoint, disabling an account, with an approval gate where the business needs one. Ticket synchronisation with the ITSM platform keeps the service desk and the SOC looking at the same reality instead of two systems that disagree.
FortiSOAR also fits the managed service model that dominates security delivery in this region. Tenancy can be hierarchical, distributed, dedicated or shared, so a provider can run tenant nodes inside customer environments and execute playbooks remotely, keeping data segregation defensible while working every case from one console. The honest caveat is that a SOAR platform amplifies whatever process you already have. If alerting is noisy and case handling is undefined, automation makes the noise faster rather than quieter. The projects that succeed start by fixing the two or three processes worth automating, then build the playbooks around them.
Talk to a FortiSOAR Expert
Whether you are scoping SOC automation for the first time, stuck on a connector that does not exist yet, or planning multi-tenancy for a managed service, I can help.
- Free initial scoping call
- Hands-on implementation, not slideware
- NESA and CBUAE response context
- OSCP-certified security background
Frequently Asked Questions
FortiSIEM and the Wider SOC Build
FortiSOAR is most often bought alongside FortiSIEM, because the automation is only as good as the detection feeding it. I have implementation experience on both, so the integration is designed rather than improvised. If you are working out how detection and response fit together as a programme, the SOC and SIEM playbook covers the architecture end to end.
Basim Ibrahim, FortiSOAR Consultant in Dubai
If you are searching for a FortiSOAR consultant in Dubai, a FortiSOAR implementation partner in the UAE, or a FortiSOAR expert for GCC deployment, you have found the right person. I am Basim Ibrahim, a Dubai-based cybersecurity consultant with genuine hands-on FortiSOAR implementation experience, covering playbook development, connector work, case management design and multi-tenant builds for managed service providers.
I deliver FortiSOAR deployment services in Dubai and the UAE from use case selection and proof-of-concept through to production handover. That includes FortiSOAR playbook development in the visual designer, FortiSOAR custom connector development when the store does not cover your tool, module and record set design, war room and SLA tracking configuration, FortiSOAR multi-tenancy for MSSP deployments, and FortiSOAR and FortiSIEM integration across the Fortinet Security Fabric.
Based in Dubai and working across UAE and GCC enterprise and service provider environments, with the NESA, CBUAE and DESC incident response expectations that drive most SOC automation projects in the region firmly in scope. An OSCP-certified offensive security background means the containment playbooks I build reflect how an intrusion actually progresses, not just what the template library assumed.