Course Overview
FortiAnalyzer: In this class, you will learn the fundamentals of using FortiAnalyzer for centralized logging and reporting. You will learn how to configure and deploy FortiAnalyzer, and identify threats and attack patterns through logging, analysis, and reporting. Finally, you will examine some helpful troubleshooting techniques. In interactive labs, you will explore administration and management; register devices for log collection with FortiAnalyzer; use FortiAnalyzer to centrally collect logs; perform a forensic analysis of logs based on simulated network attacks; create reports; and explore solutions to common misconfiguration issues.
FortiManager: In this class, you will learn the fundamentals of using FortiManager for centralized network administration of many FortiGate devices. In interactive labs, you will explore deployment strategies, which include single or multiple ADOMs, device registration, policy packages, shared objects, installing configuration changes, provisioning FortiManager as a local FortiGuard distribution server, and troubleshooting the features that are critical to day-to-day use after you deploy FortiManager.
Who should attend
Anyone who is responsible for the day-to-day management of FortiAnalyzer devices and of FortiGate security policies using the FortiManager platform.
Course Objectives
After completing FortiAnalyzer, you will be able to:
- Describe key features and concepts of FortiAnalyzer
- Deploy an appropriate architecture
- Use administrative access controls
- Monitor administrative events and tasks
- Configure high availability
- Understand HA synchronization and load balancing
- Upgrade the firmware of an HA cluster
- Verify the normal operation of an HA cluster
- Manage ADOMs
- Manage RAID
- Register supported devices
- Troubleshoot communication issues
- Manage disk quota
- Manage registered devices
- Protect log information
- View, search, manage, and troubleshoot logs
- Monitor and manage events
- Manage and customize event handlers
- Create and manage incidents
- Explore tools used for threat hunting
- Create, run, and troubleshoot playbooks
- Import and export playbooks
- Generate and customize reports
- Customize charts and datasets
- Manage and troubleshoot reports
After completing FortiManager, you will be able to:
- Describe capabilities of FortiManager
- Add FortiGate devices to Device Manager and import their running configuration
- Use provisioning templates and scripts for device-level changes across many devices
- Identify the synchronization states
- Manage the revision history of managed devices
- Offer a local FortiGuard Distribution Server to your Fortinet devices
- Deploy administrative domains (ADOMs) to support multiple customers on a single FortiManager
- Manage firewall policies across multiple FortiGate devices using policy packages with shared and dynamic objects
- Deploy policies and objects from the global ADOM to multiple ADOMs
- Explain high availability, backup, and recovery options for FortiManager
- Compare methods for centrally managing IPsec VPNs
- Explain the restricted "admin" profile and API high-level usage
- Use workspaces and workflow mode
- Identify steps to replace a managed FortiGate device
- Manage FortiGate devices' firmware centrally
Course Content
FortiAnalyzer
- Introduction and Initial Configuration
- Administration and Management
- Device Registration and Communication
- Logging
- FortiSoC-Incidents and Events
- FortiSoC-Playbooks
- Reports
FortiManager
- Introduction to FortiManager
- System Settings
- Device Manager
- Policy & Objects
- Additional System Operations