SOAR & SOC Automation Implementation Experience MSSP Multi-Tenancy

FortiSOAR Expert & Security Automation Consultant

This is implementation experience, not presales slideware. I have built FortiSOAR in production: playbooks in the visual designer, connectors including custom ones written when nothing in the store fitted, case management with war rooms and SLA tracking, and the FortiSIEM integration that turns a detected incident into an actual response.

Fortinet FortiSOAR logo
Security Orchestration, Automation and Response
  • Production implementation experience
  • Playbook and custom connector development
  • FortiSIEM and Security Fabric integration

What is FortiSOAR?

FortiSOAR is Fortinet's security orchestration, automation and response platform. The short description is that it takes alerts from wherever they originate, a SIEM, a mailbox, an EDR agent, a threat feed, and runs them through logic you designed rather than logic an analyst has to remember at three in the morning. Fortinet publishes figures of over 700 product integrations and roughly 6,500 prebuilt playbooks in the content library, alongside no-code and low-code playbook creation in a visual drag-and-drop designer.

Underneath the automation sits a proper data model, and this is the part buyers usually underestimate. FortiSOAR is built on modules, including Alerts, Incidents, Indicators, Assets, Tasks and War Rooms, each with fields, picklists, relationships and permissions you can modify. Playbooks operate on record sets from those modules, triggered manually, on record creation, on update, or by reference from another playbook. Around that sits case management: analysts work queues, escalate an alert into an incident, open a war room to collaborate on a live investigation with tasks and evidence in one place, and the platform measures response and resolution against SLA targets so team performance is reportable rather than anecdotal.

On current positioning: FortiSOAR still ships under that name and sits in the Fortinet Security Fabric next to FortiSIEM, FortiAnalyzer and FortiAI. In 2026 Fortinet launched FortiSOC, a unified cloud-delivered SOC platform that consolidates SIEM, SOAR and threat intelligence into a single service. Fortinet has been clear that FortiSOC is an additional offering for organisations that want that consolidation, that the existing individual SOC products continue to be enhanced and available, and that migration tooling is coming for customers who choose to move. So a FortiSOAR investment made today is not stranded, but it is a question worth raising at renewal.

Where I Can Help

The work that actually gets a FortiSOAR deployment into production and keeps it useful once the initial enthusiasm wears off.

Playbook Development & the Visual Designer

Building working playbooks in the drag-and-drop designer rather than importing the library and hoping. Triggers, decision branches, manual approval steps, loops over record sets, variables and Jinja expressions. Typical first builds are phishing triage from a reported mailbox and automated IOC enrichment with reputation scoring, because those return time to the analysts fastest.

Connectors, the Store & Custom Builds

Configuring and health-checking connectors from the content hub, then writing custom ones when nothing fits, which happens on most real projects. That means the connector SDK, defining operations and configuration parameters, handling authentication and pagination, and packaging it so it survives an upgrade. Also covers bidirectional ticket synchronisation with ITSM platforms such as ServiceNow and Jira.

Case Management, War Rooms & SLA

Setting up how the SOC actually works: alert queues and shift assignment, escalation from alert to incident, war rooms for live investigations with tasks and collaborators, and response and resolution SLA fields with the reporting that makes team performance visible. Done properly this is what your service level commitments are measured against, so it needs designing rather than defaulting.

Modules, Record Sets & Data Model Design

Shaping the module editor to match how your team categorises work: custom fields, picklists, relationships between alerts, incidents, indicators and assets, filters and dynamic record sets that feed dashboards and playbooks. Plus role-based access control at module and field level, which matters as soon as more than one team shares the platform.

Multi-Tenancy for MSSP Deployment

Designing dedicated or shared tenancy for a managed service, with a master node and tenant nodes, data forwarding rules controlling what moves upward, and remote playbook execution so actions run inside the customer network. Includes tenant onboarding that is repeatable instead of hand-built each time, and the access model that keeps one customer from seeing another.

FortiSIEM Integration & Fabric Response

Wiring FortiSIEM incidents into FortiSOAR alerts with the field mapping and deduplication that stops one incident becoming forty records, then closing the loop through the Security Fabric: banning an address on FortiGate, isolating a host through the endpoint agent, disabling an account in Entra ID or Active Directory, and notifying the owner before the containment lands.

Why FortiSOAR for UAE Organisations?

UAE regulation increasingly asks not just whether you detected something but how quickly you responded. NESA expects a defined and exercised incident response capability with evidence that incidents are handled and closed. The CBUAE requirements push licensed financial institutions towards continuous monitoring and demonstrable response, and DESC applies similar expectations to Dubai government-linked entities. ADGM, DIFC and the federal PDPL add breach notification timelines. A SOAR platform is how those timelines stop depending on whoever happens to be on shift, because the enrichment, the notification and the containment steps run the same way every time and leave an audit trail behind them.

The use cases that pay for themselves in a regional SOC are unglamorous and repeatable. Phishing triage is the obvious first one: a user reports a message, the playbook extracts URLs and attachments, detonates or checks reputation, decides, and where it is malicious pulls the same message from every other mailbox and tells the reporter what happened. IOC enrichment across threat intelligence sources removes the copy-and-paste loop between five browser tabs. Containment playbooks handle user and host response, blocking an address on the firewall, isolating an endpoint, disabling an account, with an approval gate where the business needs one. Ticket synchronisation with the ITSM platform keeps the service desk and the SOC looking at the same reality instead of two systems that disagree.

FortiSOAR also fits the managed service model that dominates security delivery in this region. Tenancy can be hierarchical, distributed, dedicated or shared, so a provider can run tenant nodes inside customer environments and execute playbooks remotely, keeping data segregation defensible while working every case from one console. The honest caveat is that a SOAR platform amplifies whatever process you already have. If alerting is noisy and case handling is undefined, automation makes the noise faster rather than quieter. The projects that succeed start by fixing the two or three processes worth automating, then build the playbooks around them.

700+
Prebuilt product integrations
6,500
Prebuilt playbooks in the library
600
Enterprise and MSSP customers
4.9/5
2025 Gartner Peer Insights rating
Available for engagements

Talk to a FortiSOAR Expert

Whether you are scoping SOC automation for the first time, stuck on a connector that does not exist yet, or planning multi-tenancy for a managed service, I can help.

  • Free initial scoping call
  • Hands-on implementation, not slideware
  • NESA and CBUAE response context
  • OSCP-certified security background
Get in Touch

Frequently Asked Questions

FortiSOAR is Fortinet's security orchestration, automation and response platform. It ingests alerts from tools such as FortiSIEM and email, turns them into records inside a configurable data model, and runs playbooks built in a visual drag-and-drop designer to enrich, decide and act. Around that sits case management with war rooms, task assignment, queue management and SLA tracking. Fortinet publishes figures of more than 700 product integrations and around 6,500 prebuilt playbooks in the content library.

No. Fortinet launched FortiSOC in 2026 as a unified cloud-delivered SOC platform bringing SIEM, SOAR, threat intelligence and analytics together in one service. Fortinet has stated that FortiSOC is an additional offering for customers who would benefit most from a unified platform, and that the existing individual SOC solutions continue to be enhanced and available. FortiSOAR still ships under its own name for on-premises, cloud-hosted and MSSP deployments, and Fortinet has said migration tooling will be available for customers who choose to move.

Not automatically. FortiSIEM includes notification and remediation policies and a native playbook library, which covers simple response actions such as blocking an address on a firewall. FortiSOAR earns its place when you need real case management, multi-step approval and human-in-the-loop decisions, bidirectional ticket synchronisation with an ITSM platform, SLA measurement across a team, or orchestration across dozens of third-party tools that are not part of the Fortinet estate. The clearest test is whether your analysts are copying data between consoles and spreadsheets. If they are, the automation layer pays for itself.

Yes. FortiSOAR supports hierarchical, distributed, dedicated and shared tenancy models. A provider can run a master node with tenant nodes deployed inside customer environments, forward selected records upward using data forwarding rules, and execute playbooks remotely on the tenant node so actions run inside the customer network. That structure suits UAE and GCC managed service providers because it keeps customer data segregation defensible while the SOC still works cases from one console.

FortiSIEM and the Wider SOC Build

FortiSOAR is most often bought alongside FortiSIEM, because the automation is only as good as the detection feeding it. I have implementation experience on both, so the integration is designed rather than improvised. If you are working out how detection and response fit together as a programme, the SOC and SIEM playbook covers the architecture end to end.

Basim Ibrahim, FortiSOAR Consultant in Dubai

If you are searching for a FortiSOAR consultant in Dubai, a FortiSOAR implementation partner in the UAE, or a FortiSOAR expert for GCC deployment, you have found the right person. I am Basim Ibrahim, a Dubai-based cybersecurity consultant with genuine hands-on FortiSOAR implementation experience, covering playbook development, connector work, case management design and multi-tenant builds for managed service providers.

I deliver FortiSOAR deployment services in Dubai and the UAE from use case selection and proof-of-concept through to production handover. That includes FortiSOAR playbook development in the visual designer, FortiSOAR custom connector development when the store does not cover your tool, module and record set design, war room and SLA tracking configuration, FortiSOAR multi-tenancy for MSSP deployments, and FortiSOAR and FortiSIEM integration across the Fortinet Security Fabric.

Based in Dubai and working across UAE and GCC enterprise and service provider environments, with the NESA, CBUAE and DESC incident response expectations that drive most SOC automation projects in the region firmly in scope. An OSCP-certified offensive security background means the containment playbooks I build reflect how an intrusion actually progresses, not just what the template library assumed.

Weekly Cyber Insights

One email per week. UAE/GCC focused. No spam, unsubscribe any time.