Fortinet FortiWeb ZTNA and FortiSOAR Workshop

Fortinet FortiWeb ZTNA and FortiSOAR Workshop on Azure

In this workshop you will learn how to configure ZTNA on Fortinet’s FortiWeb Web application and API protection firewall. Also in the second part of the lab you will learn how we can use FortiSOAR to quarantine a client sending malicious traffic.

About TEC Workshops

TEC Workshops provide the learner with the opportunity to put into practice newly developed skills in an easy to launch environment that can be used for customer engagements. At a minimum a TEC Workshop will include the following:

A use case description
An integrated lab and demo environment
- Informational call-outs for key points to discuss or highlight to a customer
- Questions that could be asked while giving the TEC Workshop as a demo
- Points of value that relate the business value to the technical feature
A reference architecture(s)

Optional components may be included for certain use cases

The TEC Workshop will not be a completely, self-contained learning experience for a single product. A TEC Workshop will cover features and often multiple products where they relate to the use case of interest.

Deployments will be automated for those tasks that are not salient to the learning or demonstration activity in the use case. For example, for a TEC Workshop focused on Indicators of Compromise, the system may deploy a FortiGate and FortiAnalyzer with configurations for these systems. However, the leaner will have to configure the Event Handlers for IOC setup.

FortiWeb ZTNA TEC Workshop

Introduction:

With increase in remote workforce and devices off networks, Security for accessing applications have been a challenge. ZTNA offers security for users that are not present on the network and are trying to access the applications and data. FortiWeb Web Application and API security firewall offers ZTNA with lot more other capabilities, protecting both north-south and east-west traffic. Fortiweb highlights include:

OWASP Top 10 protection signature database
Machine learning based Anomaly and Bot detection
ZTNA
API Schema protection
Machine learning based API learning

The purpose of this TEC Workshop is to familiarize the learner with FortiWeb ZTNA approach and architectural concepts specific to the Azure Cloud environment.

TEC Workshop Objectives

Lab-1:

Deploy the FortiWeb and all the required components like FortiEMS using Terraform
Configure EMS
Configure FortiWeb to provide access from Internet to Web application with ZTNA
Configure FortiWeb to provide access on a trusted network to access the web API

Lab-2:

FortiSOAR Access from FortiAnalyzer
Enable FAZ connector on FortiSOAR
Create a Playbook
Quarantine and UnQuaratine a client based on malicious traffic

Warning

The examples and sample code provided in this workshop are intended to be consumed as instructional content. These will help you understand how various Fortinet and Azure services can be architected to build a solution while demonstrating best practices along the way. These examples are not intended for use in production environments without full understanding of how they operate.

Chapter 1 - Getting Started

Provisioning the Azure environment (40min)

Provision your Azure Environment, enter your Email address and click Provision

Warning

After submitting, this page will return with a blank email address box and no other indications. Provisioning can take several minutes. \*\*\* __PLEASE DO NOT SUBMIT MULTIPLE TIMES__ \*\*\*

When provisioning is complete, one of the following will happen.

You will receive an email with Azure environment credentials. Use those credentials for this environment, even if you have your own.
You will receive and email indicating that there are no environments available to utilize. In this case please try again at a later date.
You will receive an email indicating that the supplied email address is from an unsupported domain.
No email received due to an unexpected error. You can try again or notify the Azure CSE team.

Tasks

Setup Azure Cloud Shell
Run Terraform
Verify Terraform

Task 1 - Setup Azure CloudShell

1. Setup your AzureCloud Shell

Login to Azure Cloud Portal https://portal.azure.com/ with the provided login/password
Click the link “Skip for now (14 days until this is required)” do not click the “Next” button
Click the “Next” button
Click on Cloud Shell icon on the Top Right side of the portal
Select Bash
Click on Show advanced settings
Select
- Use existing Resource Group - it should auto populate with USERXX-workshop-sdwan (USERXX is your Username)
- Use existing Storage account - it should auto populate with USERXX########## (########## is a random string)
- Use existing File Share - type cloudshellshare
Click “Attach Storage”
You should now have access to Azure Cloud Shell console

Task 2 - Run Terraform

Task 2 - Launch resources using Terraform

All the components required for Lab1 and Lab2 are deployed through terraform.

Here is the Architecture diagram for Lab1:

Perform the following steps in your Cloudshell console to create your environment.

Clone the Github repo git clone https://github.com/FortinetCloudCSE/FortiWeb-Azure-ZTNA-FortiSoar
Change directory to the cd FortiWeb-Azure-ZTNA-FortiSoar/terraform folder
Run terraform init

git clone https://github.com/FortinetCloudCSE/FortiWeb-Azure-ZTNA-FortiSoar
cd FortiWeb-Azure-ZTNA-FortiSoar/terraform
terraform init

Set the Terraform environment variables (check in dedicated the e-mail send to you by the organizers):
1. export TF_VAR_fortiflex_api_user='<api_user_sent_in_email>'
2. export TF_VAR_fortiflex_api_password='<api_password_sent_in_email>'
Run terraform apply -var='username=UserXX' --auto-approve
Your username can be found in the login email.
Say your Azure account login is fweb11@ftntxxxxx.onmicrosoft.com, your username is fweb11

export TF_VAR_fortiflex_api_user='<api_user_sent_in_email>'
export TF_VAR_fortiflex_api_password='<api_password_sent_in_email>'
terraform apply  -var='username=UserXX' --auto-approve

Terraform deployment takes atleast 25-30 min to complete. Please copy the output once the deployment is succeeded.

Chapter 2 - Basic Setup

Basic Setup

Licensing EMS
Licening FortiWeb
Create a Fabric Connector on FortiWeb for EMS
Create ZTNA tags on EMS

Task 1 - EMS Setup

1. EMS Setup and licensing

RDP to the EMS Server IP address (Terraform output) using the all_username and all_password credentials.
FortiEMS is already installed on Windows Server.
Double-Click to open FortiEMS. On the first login, username is admin/password is blank. Click Signin.
We need to Set up new password here. Please note this password as we will use this to sign in to EMS.
The FortiEMS is not licensed. We need to upload the BYOL license. License is already provided through email for the Cloud CSE team. If license is not provided you can ITF the FortiEMS license with SKU: FC1-10-EMS04-429-01-12.
To activate the license, copy the hardware ID from EMS System » Dashoboard » Status.
Login to https://support.fortinet.com, register asset with the hardware ID. Download the license document.
1. Paste the registration code from the license document, click Next
2. Paste the Hardware ID from the EMS » register
On EMS Dashboard » Status - login with the FortiCloud Account the license is registered.

2. Updating License

On EMS, we see “SSL Certificate is not Secure” at the top.
To upload a certificate to EMS, Navigate to System Settings » EMS Server Certifcates » Add. on Upload PKCS12 tab, browse to find certificate from the Dekstop.
on the Desktop, there is a folder called ems_ssl_certificates » upload EMS_Demo_Server certificate. Password for the certifiactae is password (all lower case)
In System Settings » EMS settings, for WebServer certificate select the newly uploaded certificate and also enable “use webserver cert for end point control” , click Save.
On EMS » In Endpoint Policy and components » CA Certificates » Upload the CA Certificate from the ems_ssl_certificates folder on the Desktop.
Now you should see that the EMS Certificate is SSL secure at the top.

Task 2 - FortiWeb Setup

Licensing FortiWeb

Login to FortiWeb with https://<fortiweb_pip>:8443. Fortiweb_pip IP can be found from Terraform output. Use the all_unsername and all_password as login credentials.

For licensing FortiWeb, please check your email. License is already provided. After uploading the the FortiWeb will reboot.

Its a good idea to get some coffee while it is rebooting ;)

After FortiWeb is back up, in System » Config » Feature visibility, enable ZTNA and Firewall features.

Task 3 - Connect FortiWeb to EMS

Connect FortiWeb to EMS

To connect FortiWeb to EMS, go to Security Fabric » Fabric Connectors » FortiClient EMS
Enter the IP and Port for FortiWeb to connect to FortiClient EMS, click OK.
You will see a Certificate warning to connect to EMS. Click OK.
Login to FortiClient EMS, in Administration » Fabric Device » Authorize the FortiWeb.
Once Authorized we should see that the connection is up on FortiWeb.

Task 4 - ZTNA tags creation

Creating ZTNA tags on FortiEMS

We need to create ZTNA tags to tag endpoints that connect to FortiClient. These tags will sync with FortiWeb and can be used in ZTNA rules.

To create tags, on FortiClient EMS navigate to Zero Trust Tags » Zero Trust Tagging rule » Add.
Enter name: windowsclient, tag endpoint as: windows (Press Enter for creating a new tag), click Add rule
In the rule, Select Windows, in OS type: Windows, add the Windows version as shown below.
Repeat Same steps for Linux.
Also Create another tag for windows vulnerbale device as show below.
By default we cannot see ZTNA tags when Endpoints connect to Zero Trust telemetry. For ZTNA tags to be visible on FortiClient, you need to enable in FortiEMS.

On FortiEMS » Endpoint profiles » System Settings » Advanced » enable show zero trust tag on FortiClient GUI.

Chapter 3 - ZTNA North-South

North-South ZTNA traffic

Set up FortiWeb Policy
Set up ZTNA policy on FortiWeb
Test ZTNA North-South access.

Task 1 - FortiWeb Policy setup

FortiWeb Policy setup

Before creating ZTNA profiles and Tags, We need to create a Server policy on FortiWeb. To create a server policy set up a server pool on FortiWeb.
In Server Objects » Server Pool » Create new » Enter as shown below » Click OK
Click Create New to create a new server in Server pool as below.
Now, Create a Virtual Server. Server Objects » Virtual Server » Create new » click OK

Now we will create a Virtual Server to listen on Port1 IP address

Create a certificate in Server Objects » Certificates » CA Group
Create New CA group for FCTEMS and click OK.
Select Type CA, Select CA for FCTEMSXXXXXXX certificate as the CA, Click OK.
Create a Server policy , in Policy » Server Policy » Create New as shown below.

For Server pool, Virtual Server select the objects you created in Step 2 and 3. For HTTPS service select HTTPS

Click Advanced SSL settings, For Certification verification for HTTPS click create new:
In the New Certificate Verify Tab, select the CA you have created earlier in Step 6. Finally Clik OK on the server policy.

ZTNA Policies on FortiWeb

Before setting up FortiWeb ZTNA rules, check if the ZTNA tags synced from FortiClient EMS to FortiWeb. On FortiWeb navigate to ZTNA » ZTNA profile » ZTNA tags. FortiWeb Might have to scroll to the end to see the tags created in earlier step.
Create ZTNA rules to access the FortiWeb Web Server. Click OK.
Click on Add Condition, Select Type: ZTNA Tag, from Tag list Windows, Match condition: Any, click OK.

In ZTNA profile, Create ZTNA profile with name WebServerAccess, Set Default action to Alert and Deny. Click OK.
For ZTNA Profile Member » Create new » Update to Add the rule you created in Step 9.
Now go back to Server Policy » Policy » Edit the existing Policy.
Scroll down to ZTNA profile and assign the profile created in previous step and click Save.

Task 2 - Verify North-South Traffic

Test ZTNA North-South Inspection

To Test N-S Access, RDP to Windows10 Client (windows_client_pip address is in Terraform Output)
on Windows 10 VM, the FortiClient is already installed. Double click on FortiClient EMS, Click on Zero trust telemetry
In Zero Trust Telemtry » Input the IP of your Windows » Click Connect
Once the FCT is connected to EMS, you should see a Windows Tag assigned to FCT.
Open a browser on Windows Cliet and type https://10.0.0.4 in the browser or the Public IP address of FortiWeb the Port1 is NAT’d. Remember Virtual Server we created is listening on Port1 of the FortiWeb with IP 10.0.0.4.

You can also check to get to the API documentation by typing https://10.0.0.4/docs

Repeat the same step from your local machine. You should not be able to get to the FastAPI web page since you are not conencted to FCTEMS.

Chapter 4 - Microsegmentation

East-West ZTNA microsegmentation

Setup E-W ZTNA microsegmentation.

Task 1 - East-West ZTNA traffic

East-West inspection

Now that Server policy is all setup, for microsegmentation within trusted network using ZTNA we need to edit the ZTNA profile. Also, since FortiWeb has a firewall we will be using a firewall policy to prevent traffic between trusted network.
lets create a static route to get to the internal VNET through port2 in Network » Route » Static route.

Also Lets create a firewall policy. In System » Firewall » Firewall Policy » Firewall Service.
1. Create a Service for ICMP
2. Create another service all, by leaving everything to default.
To create a firewall policy , set the default action to “Accept” also create policies as shown below to deny the icmp traffic and also all Port1 to port2 traffic.
SSH to the webserver_public_ip to register it to FortiEMS using the below command. forticlient_ems_server_public_ip can be found in Terraform output log.
Once registered you should see the WebServer and APIServer on FortiEMS Endpoints module.
forticlient epctrl register "<forticlient_ems_server_public_ip>"
Now in ZTNA profile, update the already created ZTNA rule to add Linux tag.
Linux VM is already connected to the EMS. You can check endpoints connected to EMS.
Now SSH to the other trusted Linux VM (IP address is in Terraform output) to get to the API server. once logged in type the below command.
curl --insecure https://10.0.0.4
curl --insecure https://10.0.0.4/docs

You should see hello world response from the first command and also swagger html as a response from the /docs

Now try the same to hit the trusted server directly.
curl --insecure https://10.0.1.5
curl --insecure https://10.0.1.5/docs

LAB - 2

Lab Architecture Diagram

This Diagram provides a high-level overview of the deployed Systems and the corresponding internal IP addresses. FortiSOAR is deployed as a Management Extension on FortiAnalyzer VM

Chapter 5 - FortiAnalyzer and FortiSOAR

Introduction

In this lab, we will begin by providing a brief introduction to FortiSOAR. FortiSOAR is a comprehensive Security Orchestration, Automation, and Response (SOAR) platform. It offers a centralized and integrated solution for managing security incidents, automating response actions, and streamlining security operations.

After familiarizing ourselves with FortiSOAR, we will proceed with a series of initial steps to get acquainted with the platform’s interface and functionalities. This will help you gain a better understanding of how FortiSOAR operates and how it can be utilized in real-world scenarios.

Once we have covered the foundational aspects of FortiSOAR, we will move on to the core focus of this lab: developing your own playbook to respond to an incident reported by FortiClient EMS.

By combining the knowledge and skills acquired from previous labs, specifically the Zero Trust Network Access (ZTNA) lab with FortiWeb, you will create a playbook tailored to react efficiently to the incident. This will involve integrating the insights gained from the ZTNA lab, where you explored the secure access capabilities of FortiWeb.

During the playbook development process, you will leverage FortiSOAR’s capabilities to automate response actions based on predefined conditions and triggers. These actions may include gathering additional information, analyzing the incident’s severity, identifying affected endpoints, and implementing appropriate remediation measures.

By the end of this lab, you will have hands-on experience in utilizing FortiSOAR’s features to create a customized playbook that combines the knowledge obtained from previous labs, particularly the ZTNA lab with FortiWeb. This exercise will help you understand the practical application of FortiSOAR in incident response and further enhance your proficiency in leveraging security automation tools.

Overview

This lab is built as an extension of the previous Lab (ZTNA with FortiWeb). Additionally, FortiAnalyzer & FortiSOAR will be introduced as tools to solve the upcoming task.

There is no need to apply any additional Setup steps as the infrastructure already got deployed at the beginning of the previous Lab.

As similar Scenario is show in the following video by the Product Manager of FortiSOAR. In this Video, Malicious traffic got detected from a specific Workstation. With the help of FortiSOAR and the ML Engine, the SOC analyst get provided with various quick actions and additional information which helps to Quarentine the Client and mitigate the issue within seconds.

Task 1 - Preparation of FortiAnalyzer and FortiWeb

Prepare FortiAnalyzer and FortiWeb for the Lab

This Chapter includes necessary steps to setup Log shipping and Event Monitoring with FortiAnalyzer of FortiWeb. Please make sure you have completed this section before moving on!

FortiWeb Preparations

On the left sided menu, goto Log&Report - Log Policy - FortiAnalyzer Policy

Select Create New at the top left to open the Configuration Wizard

Provide a meaningful name for the Policy and the click OK to save

After the Policy has been saved, click on Create New to a add a new entry to the policy
Enter the IP Address of Fortianalyzer into the corresponding field, then click on OK to add the entry

Check that the new entry was added successfully, click OK again to make sure that everything is saved.

On the left sided menu, goto Log&Report - Log Config - Global Log Settings

Enable FortiAnalyzer and select the previous configured FortiAnalyzer Policy

Click on Apply at the bottom of the Page to save the configuration.
To enable the global logging, open the built-in CLI by clicking on the >_ Symbol the to top right

Execute the following commands

config log traffic-log
set status enable
end

Logging of FortiWeb to FortiAnalyzer is now enabled. Please proceed with the configuration of FortiAnalyzer

FortiAnalyzer Preparations

Goto Device Manager and click on Add Device to add FortiWeb

Provide the follwoing Information, then click on Next to proceed with the configuration.
- Name: FortiWeb
- Serial Number: (This can be found at the Dashboard of FortiWeb)
1. Wait until the Device got added successfully. Then click on Finish to close the wizard.
1. To finalize the FortiWeb configuration, select the entry from the Device table and click on Edit
1. Update Admin User and Password with the given credentials, then click on OK to save.
1. To be able to feed Security Events within FortiSOAR, Events need to get generated within the Event Monitor. For this to work, a so called Handler needs to be in Place. The Handler for FortiWeb is disabled by default and needs to be enabled. For this, goto Incidents & Events - Handlers
1. Select the Basic Handlers Tab, then use the Search field at the top right to search for FWB
1. Right click on the search result, click on Enable to activate the handler.
1. Check that the Status changes from disabled to enabled (green checkmark)
1. As soon as FortiWeb detects an attack, a new Event entry will get added. See the following Example:
Please make sure, that a Web Protection Profile is used within the configured FortiWeb Policy. The default policies provided by FortiWeb are more than enough with regards to this lab.
Congratulations, you are done with the preparations. Please continue to the next Section of the Lab.

Chapter 6 - FortiSOAR Overview

Introduction to FortiSOAR
FortiSOAR Content Hub & Connectors

Task 1 - Introduction to FortiSOAR

How to Connect to FortiSOAR Webinterface

Open the URL of FortiAnalyzer, using the Public IP Address (e.g. https://20.234.157.6)
Login into FortiAnalyzer with the provided lab credentials

In the FortiAnalyzer Setup Wizard, click on Next, then keep the default hostname and click on Nextagain.

Click on Finish to complete the Setup

At the left side menu, select Management Extension

if not automatically selected, click on FortiSOAR to access the FortiSOAR Webinterface. In Case not already done, accept the Terms and Service by Scrolling down to the Bottom of the embedded Site and click on Accept

The FortiSOAR Dashboard Page should be now visible as a iframe

Congratulations, you have successfully logged into FortiSOAR. Proceed with the next Chapter.

Install Licenses into FortiSOAR

By default, FortiSOAR comes with a limited Perpetual license. This type of license provides you with a free trial license an unlimited time for FortiSOAR, but in a limited context, i.e., with restrictions on the number of users and actions that can be performed in FortiSOAR in a day. By default, this license is an “Enterprise” type license and is restricted to 2 users using FortiSOAR for a maximum of 300 actions a day.

Within the FortiSOAR WebUI, select the Gear icon at the top right.

In the System Configuration, goto the License manager

Copy the Device UUID and enter into the Support Portal to be able to Download the licenses file.

Upload the license file via Update License
Drag’n Drop / Select the license file, then click on Install License File

Confirm the Installation of the new license

If you recive an error like below, wait some minutes and repeat the step

Validate that the new license has been installed correctly

Incident and Alarm Handling in FortiSOAR

Incident and alarm handling are crucial components of any security operation. When security incidents occur or alarms are triggered, it is essential to have a systematic and efficient approach to address them. FortiSOAR provides a centralized platform to manage and handle incidents and alarms effectively.

With FortiSOAR, security incidents and alarms from different security devices and systems, such as FortiWeb and FortiClient EMS, can be consolidated and correlated in a single dashboard. This consolidation allows security teams to gain a comprehensive view of the security landscape, enabling faster and more accurate incident response.

FortiSOAR automates the initial triage and categorization of incidents and alarms, reducing the manual effort required. It applies predefined playbooks or workflows to incidents based on their severity, type, or other criteria. Playbooks consist of a series of automated actions, such as gathering additional information, enrichment, containment, and remediation. By automating these repetitive and time-consuming tasks, FortiSOAR enables security teams to focus on more critical and strategic activities.

More Information can be found in the FortiSOAR User Guide - Working with Modules - Alerts & Incidents

How to access the Alarms & Incident section

Expand the sidebar menu by clicking on the arrow the at top left

Select Incident Response - Alerts to access the recived alerts and events

This Section is empty at the moment. The further we get in the lab, the more alerts there will show up.

The Incidents can be found in the same menu right after the Alerts

Incidents are usually a group of multiple events and can contain multiple Alerts and Indicators.

Task 2 - FortiSOAR Content Hub

FortiSOAR Content Hub & Connectors

Content Hub is a vital component of FortiSOAR that provides a centralized repository of pre-built playbooks, scripts, and integrations. It serves as a knowledge base and resource center for security operations, allowing teams to leverage existing content and collaborate effectively.

Content Hub offers a vast collection of pre-defined playbooks created by Fortinet’s experts and the broader cybersecurity community. These playbooks cover a wide range of use cases, including incident response, threat hunting, vulnerability management, and compliance. By utilizing these pre-built playbooks, security teams can accelerate their response times and ensure consistency in their incident handling processes.

In addition to playbooks, Content Hub provides access to a variety of integration connectors. These connectors allow FortiSOAR to connect and interact with different security tools, such as FortiWeb and FortiClient EMS, as well as third-party solutions. This seamless integration capability ensures that incidents and alarms from various sources can be ingested, analyzed, and responded to from a single platform.

Furthermore, Content Hub enables collaboration and knowledge sharing among security professionals. It allows users to contribute their playbooks, scripts, and integrations to the community, fostering a vibrant ecosystem of security automation. This collaborative approach encourages the exchange of best practices and empowers security teams to continually improve their incident response capabilities.

More Information can be found in the FortiSOAR User Guide - Content Hub

How to access the Content Hub

If not already done, expand the sidebar menu by clicking on the arrow the at top left
Select Content Hub to access the recived alerts and events
A whole new view gets populated. This allows to search and filter for various Connectors, Solution Packs and Widgets to advance FortiSOAR

The same information can be also found at the FortiSOAR Content Hub Webpage

Install FortiAnalyzer Connector

Search for FortiAnalyzer in the Searchbar
Select the Fortinet FortiAnalyzer Connector. A new overlay Window appear which provides more details and the ability to install the connector.
To Install the selected Connector, click on Install at the bottom left of the Popup.
To start the Installation, click on Confirm
Wait until the Connector Installation has been completed
After the successfull Installation, it will automatically return back to the Connector Popup which provides now additional configuration fields
Add a new configuration with the information show on the screenshot. Adjust the values to fit the information provided for the lab.

Note: Please uncheck the Verify SSL option as the lab is using a self signed certificate.

Click on Save and validate that all Steps of the configuration verification, including the Health check are successfull.
Close the Configuration Popup.
The Installed Connector can be viewed in at the Manage Tab

Setup FortiAnalyzer Data Ingestion

Connectors in FortiSOAR can be used to tak action or to ingest Data into FortiSOAR like Assets, Events or Indicators, etc. Some Connectors, for example the FortiAnalyzer Connector allow to Ingest Data & take actions like Run Report, LIST LOG FIELDS, etc. These actions can be used within a playbook to “do something”. We will have a closer Look into Playbooks and how Connectors can be used in the next Chapter.

To view the predefined actions of a Connector, select the Actions & Playbooks Tab after you have selected a Connector

To Configure the Data Ingestion of FortiAnalyzer, for example to feed Events generated by FortiClient EMS into FortiSOAR, take the following steps:

In the FortiSOAR menu sidebar, goto Content Hub, select the ManageTab
In the Searchbar type FortiAnalyzer
Select the FortiAnalyzer Connector, and click on Configure Data Ingestion at the right side of the Window
A new Overlay Popup will appear. Click on Let's start by fetching some data to start the configuration process
To configure field mappings with example data, adjust the default value as shown below and continue by clicking on FETCH DATA at the bottom right corner
keep the default field mappings and continue with the configuration by clicking on the button at the bottom right corner
In this lab, we will manually trigger the ingestion as the Lab is using an unlicensed version of FortiSOAR. This is limited to 300 Actions per day which also includes Data ingestion. In an production environment, a Schedule would be configured to automtically ingest the data and add the alerts to FortiSOAR.
Finish the configuration of the Data Ingestion by clicking on the Save Settings & Continue at the bottom right corner.
Click at OK at the bottom right of the screen to close the PopUp.
Close the Connector configuration Wizard PopUp.
To Manually ingest the Events, goto Automation - Data Ingestion at the left side Menu
An overview of all availibe Connectors wich allow Data Ingestion will appear.
By selecting the Fortinet FortiAnalyzer entry, an overview of the availible configurations will appear. Select Trigger Ingestion Now at the right to feed in availibe events and alerts.
A banner at the top of the page will appear which confirms that the ingestion is running.
To view the results, switch to the Incident Response - Alert Section and view the events getting added to FortiSOAR.

Install FortiClient EMS Connector

In the Content Hub menu, go back to the Discover Tab and search for FortiClient EMS
Select the Connector and install if not already done.
Setup a new Configuration as shown below. Adjust the values to fit the information provided for the lab.
Click on Save and validate that all Steps of the configuration verification, including the Health check are successfull.

Chapter 7 - FortiSOAR Playbooks

Introduction to FortiSOAR Playbooks

Playbooks play a pivotal role in security orchestration and automation, and FortiSOAR stands out by providing a comprehensive library of pre-built playbooks delivered by default. These playbooks, designed by Fortinet’s cybersecurity experts, offer a significant advantage compared to other competitors in the market.

The default playbooks provided by FortiSOAR serve as a robust foundation for organizations to establish efficient and effective incident response workflows. These playbooks cover a wide range of security scenarios, including malware detection and response, phishing incidents, network intrusions, and more. They encapsulate industry best practices and incorporate Fortinet’s extensive threat intelligence, ensuring that organizations have access to the latest and most effective incident response methodologies.

By leveraging these pre-built playbooks, security teams can significantly accelerate their incident response processes. Rather than starting from scratch, they can quickly customize and adapt the provided playbooks to align with their specific organizational requirements. This saves valuable time and resources, allowing security teams to respond promptly and effectively to security incidents.

More Information can be found in the FortiSOAR Playbooks Guide

Task 1 - Create your own Playbook

Playbook Editor

To start with the creation of a new Playbook, take the following Steps:

Goto Automation - Playbooks

Choose any Collection you want (for example 01 - Drafts Collection), then click on + Add Playbook
Provide a new Name for the Playbook, keep the default values and then click on Create

The Playbook Editor is now open and ready to use.

Every Playbook has to start with the Trigger Step This could be e.g. Manual if you do not want to have it executed automatically or if e.g. the Playbook should get executed when a new Alert is created, choose the On Create Trigger.

For more information about the Trigger Step, please have a look at the FortiSOAR Playbook Development Guide

After selecting a Trigger, the Name and Execution Behaviour (Scope) needs to be defined. For Example, if the Playbook is used to reaction on an Alert, The Alerts Module would be selected. Multiple selections are possible if the Playbooks can be also used for other Modules.

In my case, I do not require any input to run, but the playbook should only be used in the Alerts Module.

If done with the configuration of the Step, select Save at the bottom left of the Pop-up.

Now we have added our first Playbook Step - Good Job!

Before we will execute our Playbook to validate the functionality, change the Mode to DEBUG. This is important, as by default the INFO Mode only provides us if the Playbook run was successfull or not. This is to save space within the database and not filling it up with unneccessary details at runtime. While Development, we want to see which Variable and Step has which Output or Values assigned to make it easier in case of troubleshooting.

Within the Playbook Editor, click on INFO at the top right corner

Select DEBUG from the dropdown menu and click on Apply

To Execute a Playbook, click on the “Play”-Button the the top right of the Playbook Editor.

Don’t forget to regularly press Save Playbook button to not loose your work. This is also required, before executing a Playbook.

Let’s continue adding some Steps to our Playbook in the next Section.

Playbook Steps

To add a new Step, just “drag and drop any highlighted connecot points to add a new Step”.

At the left side, a new Pop-up appears which allows you to choose the type of the new Step.

Depending on what you want to do/achieve, select the Step. To specify a Variabl use the Set Variable Step from the Core Steps. If you want to trigger an action e.g. within FortiClient EMS or use any availabile activity from our FortiSOAR COnnectors, use the Connector Step from the Execute Section, and so on. Find more details about the different Steps and capabilities within the FortiSOAR Playbook Development Guide

I will first set a Variable as a next step. After selecting the Step Set Variable I have to choose a Name and then specify the variable name and it’s Content. As a Value, FortiSOAR allows to use Jinja2 Expressions and Filters.

To see some examples, select the Functions or Input/Output Tab after you have clicked into the Value field

In my case I do not have any value I want to reference to, so I will just add a String as value.

Save the step by clicking on the button at the bottom left.

Lets add another Set VariableStep which will access the previous added variable. For this, we need to provide a Name for the Step and a Name for the variable.

After clicking into the Value field, you will notive that the previous Variable appears on the right under the Input/OutputTab

By selecting the Custom Variable example the Jinja2 Expression will be automatically added as Value.

As an alternative, you can also write {{ vars. example }}

In case the next Step within a Playbook requires to use Values from a previous Step, FortiSOAR offers a very easy solution to access those. Just select the correlating Step within the Pop-up menu and follow the tree structur to select the required variable name.

Click on Save to save our progress. Also don’t forget to save your Playbook.

The Playbook should look similar like the following:

Let’s run out created playbook. For this click on the “Play”-Button as described above. As no input is required, click on Execute at the bottom left.

The Execution Log will appear.

To debug the Playbook Steps, select the set variable Step. This allows to have a closer look what was the Input &Output of the Step.

Looking at the second Step, at the Input Tab you will see the Jinja2 Statement on how we accessed the Variable

And the Result can be viewed within the Output Tab

This was a very simple Playbook but for now this is everything you need to know to solve Challenge.

In the next Section, you will find some useful Jinja2 expression examples and Links which can be very handy.

If the Playbook ist done, you can use it e.g. within the Alerts Section. For this, just select an exiting alert and choose the Execute Menu entry at the top. The select the corresponding Playbook you want to execute.

Jinja2 Filter and Functions

Fortinet provides a very comprehensive Guide which describes all Jinja2 Filters and functions in detail: FortiSOAR Jinja2 Filter & Functions

access variable example

{{ vars.example }}

access Step variable (List) output

{{ vars.example[0].value1 }}

For loop

{% for item in vars.example %} 
	{% if item == 'TEST' %}
	Yes  {% endif %}
{% endfor %}

If condition

{% if 1485561600000 > 1484092800000 %}
        {{vars.input.records[0]}} 
            {% elif 5==6 %}
        {{vars.input.records[0]}} 
{% endif %}

ipaddress Filter

{{ test_list | ipaddr }}

Chapter 8 - Challenges

You will be working on two challenges in this section.

Quarantine client based on maclicious activity
Unquarantine client

Task 1 - Quarantine Client

As a first Task in this lab, you will develop your own Playbook to quarantine Client on FortiClient EMS. Based on the Informaition you have learned in the Prvious Chapter, the Playbook has to accomplish the following tasks:

The Information of the Client need to be extracted based on a Security Event / Alert retrived from FortiAnalyzer/FortiWeb
- To trigger an Attack alert, make sure that a Security profile is configured within the FortiWeb Policy, in addition, feel free to use the following string and just append it to the URL to trigger an Attack Alert
```
?q=%27%20or%20data%20@>%20%27{"a":"b"}%27%20--
```
Retrieve more details based on the Alert Information about the Client
Provide Approval Wizard before Quarantine Client with the following Information
- FortiClient EMS ID
- Client IP
- Reason to Quarantine
- OS Version
- FortiClient Version
Quarantine Client on FortiClient EMS
Don’t forget to think about the case, that the Approval get’s rejected.

Hint

In case you will use the Get all Endpoints function of the FortiClient EMS Connector, the following Values are required:

Value for Field: Verifiction:

{
  "saml_id": "",
  "ldap_ids": []
}

Value for Field: Filter:

<Specify you filter here - have a look into the example playbook>

Task 2 - Unquarantine client

2 - Unquarantine Client

As the last Task, you have developed a Playbook which allows to quarantine a Client via FortiClient EMS. As you may notice, you have lost remote access to the Client. Your next Task is to develop a Second Playbook which will unquarantine the previous Client based in the same Input Values like in Task 1.

For this, the Playbook has to accomplish the following tasks:

Retrieve more details based on the Alert Information about the Client
Provide Approval Wizard before Quarantine Client with the following Information
- FortiClient EMS ID
- Client IP
- Reason Client got Quarantined
- OS Version
- FortiClient Version
Unquarantine Client on FortiClient EMS
Don’t forget to think about the case, that the Approval get’s rejected.

Solution - Task 1

Challenge 1 Solution

In this Section you will find a detailed solution of the previos tasks. In addition, there are example Playbooks attached which you can import as a solution.

Example Playbook Overview

Download Example Playbook

Step Details

Stepname: Start

This is the Intitial Step. It is configured to start Manual and the Scope is defined to be only relevant for Alerts

Stepname: extract alert source data

FortiSOAR attaches by default the complete source data to every alert. This includes also non-visible information. As this Playbook extracts the Client IP address and for a better readablity, the source data will be extracted into it’s own variable.

Stepname: extract client details

Based on the source data of the alert, the client ip address and the alert subject would be relevant for further use. These get stored within their own variables.

Stepname: get all endpoints filtered

This step will use the FortiClient EMS Connector to retrieve all endpoints but with a filter based on the client ip address based on the information of the alert.

Stepname: approve quarantine

Before quarantine the client, a approval step based on the Manual Input Step is defined. This Step will output various details as requested by the Task and proceeds depending on the Button which is selected by the User.

Stepname: quarantine client

This step leverages the FortiClient EMS connector to quarantine the Client based on the client id which can be extracted of the result of step get all endpoints filtered

Stepname: cancel execution

This step is just an empty step which does nothing but ends the execution of the Playbook.

Solution - Task 2

Challenge 2 Solution