FORTINETFortinet NSE 6 - FortiSOAR Analyst
The Fortinet NSE 6 - FortiSOAR Analyst certification validates your ability to operate and manage FortiSOAR, Fortinet's security orchestration, automation, and response (SOAR) platform. It is designed for security operations professionals who build and maintain automated incident response workflows. Earning it demonstrates that you can streamline SOC operations and accelerate threat response with FortiSOAR.
309 practice questions · Updated 2026-07-30
5Domains
17Objectives
78Concepts
309Questions
NSE6-FORTISOAR-ANALYST Curriculum
Every domain, objective, and concept the NSE6-FORTISOAR-ANALYST exam measures.
- Automation vs. Orchestration
- FortiSOAR System Components
- FortiSOAR Interface Navigation
- Content Hub Usage
- SOAR vs. SIEM
- Deployment Model Options
- SME, agents, and tenant nodes in FortiSOAR
- Agent connectivity in FortiSOAR
- Solution pack content
- Use case: picklist in data model
- Use case: module in data model
- Use case: visual correlation in data model
- Access control fundamentals
- User management
- Role-based access control (RBAC)
- Team creation and membership
- Team hierarchy
- Record ownership
- Record assignment
- Ownership vs assignment comparison
- Template configuration
- Dashboard configuration
- Widget configuration
- Playbook basics and steps
- Playbook logic design
- Data ingestion
- Preprocessing rules
- If/elif/else logic
- Step conditions
- Operators in conditions
- Loops and for-each loops
- Loop variables
- Step utility actions
- Jinja and JSON introduction
- Dynamic variables and functions
- Basic Jinja filters
- JSON Query Syntax
- YAQL Query Syntax
- JSON vs YAQL Use Cases
- FortiSOAR incident lifecycle
- Incident phase management
- MITRE ATT&CK mapping
- Using MITRE ATT&CK in incident response
- Incident handling workflow
- Queue creation
- Queue assignment
- Shift creation
- Shift assignment
- Queue and shift integration
- War room fundamentals
- Creating and configuring war rooms
- Managing war room participants
- Facilitating collaboration in war rooms
- Monitoring and closing war rooms
- Link-related records
- Visual correlation
- Incident phases mapping
- REST API fundamentals
- FortiSOAR API usage
- FortiManager API integration
- Custom connector development
- HTTP methods for CRUD operations
- FortiSOAR REST API fundamentals
- Using FortiSOAR REST API for CRUD
- Custom triggers and API interaction
- JSON-RPC basics
- REST and JSON-RPC comparison
- Connector build steps
- Playbook logging level configuration
- Interpreting executed playbook logs
- Examining step input and output
- Jinja expression syntax
- Jinja expression evaluation
- Common Jinja expression errors
- Executed playbook logs
- Reading playbook execution logs
- Key log files for troubleshooting
- Service status verification
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for NSE6-FORTISOAR-ANALYST, so none is invented.