NSE6_FSR-7.3 Fortinet NSE 6 - FortiSOAR 7.3 Administrator Questions and Answers

In FortiSOAR, when a user is configured with "Concurrent" access type, their ability to log in depends on the availability of concurrent user seats. This means the user can only log in if there are available seats in the concurrent pool. If all seats are occupied, the user must wait until a seat becomes free. Thisconfiguration allows multiple users to share a pool of licenses, making it suitable for environments where not all users need constant access​.

The fdn.log file in FortiSOAR contains logs related to license synchronization activities. This log file records events and errors associated with license checks and synchronization with Fortinet's licensing servers, ensuring that the FortiSOAR instance remains compliant with licensing requirements. Monitoring fdn.log can help administrators troubleshoot issues related to license synchronization and ensure the system operates within the licensed limits​.

Upgrading a FortiSOAR HA cluster follows the same procedure regardless of whether it is configured in an active-active or active-passive setup. The process generally involves upgrading one node at a time to minimize service disruption. Best practices recommend upgrading the passive secondary node first before moving to the active primary node. This sequence helps maintain cluster stability and ensures that at least one node remains operational during the upgrade​.

In a FortiSOAR High Availability (HA) cluster setup with an externalized PostgreSQL database, it is necessary to configure the database server to allow incoming connections from all FortiSOAR nodes. This configuration involves modifying the pg_hba.conf file to set up host-based authentication and control which IP addresses can connect. The postgresql.conf file must also be adjusted to enable listening on all necessary IP addresses, which is critical for FortiSOAR nodes to connect to the database server securely and reliably. Together, these configurations ensure that all FortiSOAR nodes can access the database, facilitating effective HA functionality​.

In FortiSOAR, appliance users are accounts that represent non-human entities, such as system processes or integrations. These users do not require login IDs and therefore do not contribute to the licensing user count. Appliance users are configured for backend tasks or to interact with external systems, enabling automated processes without consuming standard user licenses. This approach optimizes system resources and keeps licensing costs manageable​.

In a FortiSOAR HA configuration, certain ports must be open for communication between nodes. Port 5432 is required for PostgreSQL database communication, which is essential for data replication between HA nodes. Port 9200 is used by Elasticsearch, which FortiSOAR leverages for indexing and search functions across the nodes. These ports must be accessible between nodes to ensure seamless operation and data consistency within the cluster​.

In FortiSOAR, the "Application Administrator" role is a default role that holds broad privileges, including the ability to assign permissions to other teams. This role is fundamental to system administration and is recommended not to be removed as it provides crucial administrative capabilities. Removing or modifying this role could impact FortiSOAR's ability to manage user roles and permissions effectively, which could hinder system operations and user management​.

In FortiSOAR, the service responsible for the playbook scheduling functionality is colcrybeatd. This service manages the timing and execution of scheduled playbooks, allowing for the automation ofvarious tasks at specified intervals. It ensures that playbooks execute according to their configured schedules, which can include tasks such as data ingestion, threat detection, or incident response actions. Proper functioning of this service is essential for the reliable automation of time-dependent processes within FortiSOAR​.