In a FortiSOAR High Availability (HA) cluster setup with an externalized PostgreSQL database, it is

necessary to configure the database server to allow incoming connections from all FortiSOAR nodes.

This configuration involves modifying the pg_hba.conf file to set up host-based authentication and

control which IP addresses can connect. The postgresql.conf file must also be adjusted to enable

listening on all necessary IP addresses, which is critical for FortiSOAR nodes to connect to the

database server securely and reliably. Together, these configurations ensure that all FortiSOAR nodes

can access the database, facilitating effective HA functionality​.

In FortiSOAR, appliance users are accounts that represent non-human entities, such as system

processes or integrations. These users do not require login IDs and therefore do not contribute to the

licensing user count. Appliance users are configured for backend tasks or to interact with external

systems, enabling automated processes without consuming standard user licenses. This approach

optimizes system resources and keeps licensing costs manageable​.

In FortiSOAR playbooks, the "Create Record" and "Update Record" steps are categorized under the

"Core" category of playbook steps. Core steps are essential actions that are frequently used in

playbooks to interact with records in the FortiSOAR database. They include fundamental operations

such as creating, reading, updating, or deleting records within modules. These steps are crucial for

the automation of tasks such as data management, where playbooks need to create new entries or

update existing data as part of incident response workflows​.

When importing modules into FortiSOAR using the configuration wizard and selecting "Merge with

Existing" as the bulk action, the behavior for field handling is as follows: any fields that already exist

in the system are overwritten with the imported values. New fields from the imported module are

added to the system, while fields that are not part of the imported module remain unaffected and

are retained in the system. This option ensures that existing data structures are updated with new

information without losing existing, but non-imported, fields​.

:

In FortiSOAR, SLA (Service Level Agreement) templates can be created for specific modules, including

Alerts and Indicators. These templates are essential for tracking response and resolution times,

ensuring compliance with defined service levels. By configuring SLAs on the Alerts and Indicators

modules, organizations can monitor the time taken to address these items, which is critical in

maintaining efficient incident response and management practices. The SLA templates can be

customized according to specific business requirements and are applied to records within these

modules to enforce timely actions​.

In FortiSOAR, the "Application Administrator" role is a default role that holds broad privileges,

including the ability to assign permissions to other teams. This role is fundamental to system

administration and is recommended not to be removed as it provides crucial administrative

capabilities. Removing or modifying this role could impact FortiSOAR's ability to manage user roles

and permissions effectively, which could hinder system operations and user management​.

:

The FortiSOAR perpetual trial license includes limitations on both the number of users and the

number of actions that can be performed. These restrictions are in place to provide prospective users

with a functional evaluation of FortiSOAR while limiting its usage in a production environment. The

trial license does not support multi-tenancy and restricts the overall capacity for scaling, making it

suitable only for testing and familiarization with FortiSOAR’s capabilities​.

: