Browse
Playbooks, solution packs and connectors shared by the community.
25 results
Call any EC2 API action, including all-protocol rules
A clone of the AWS EC2 connector that adds a generic boto3 passthrough operation, so any AWS API action can be called without waiting for a curated operation…
Call any HTTP API with shared auth and paging
Call any REST API with absolute URLs, auth set once in the configuration, and automatic paging.
Display the FortiManager SOC report on a record
Display the FortiManager SOC report inside a record view.
Give firewall owners a dashboard of their devices and policies
A dashboard for firewall owners: device status, policy hit counts and announcements in one view.
Graph each device's automation steps
Renders a Cytoscape.js node graph of a ZTP device's automation-step run-group (ztpf_device_automation_steps), ordered by step number ascending.
Manage cloud-managed firewalls, report schedules and backups
Add and manage devices, schedule reports, set config auto-backup, and call the FortiOS API through FortiGate Cloud.
Pull autonomous pentest findings and weaknesses
Pull NodeZero pentest results, weaknesses and affected hosts into your playbooks.
Query, investigate and ingest SIEM incidents
Query events and the CMDB, investigate incidents asynchronously, and ingest incidents natively.
Render playbook actions on a record view
Configure a connector action or playbook on the edit panel; the widget executes it on the view panel against the current record (params can use Jinja for…
Report on ZTP runs by run group, device and step
Run-group-first ZTP dashboard: a narrative headline, per-device and per-step results, and charts.
Run Ansible playbooks, modules and roles
Executes Ansible playbooks, ad-hoc modules, and roles directly from FortiSOAR playbooks using ansible-runner, returning structured per-host and per-task…
Run unrestricted Python from a playbook step
Execute Python snippets with no sandbox restrictions: top-level return works and open()/filesystem access is available.
Send email with templates and attachments
Send email via SMTP (stdlib smtplib, pydantic-validated, returns a structured result).
Show live elapsed time for a ZTP run group
A live count-up clock for one ZTPF run group.
Verified response playbooks for common SOC use cases
Ten playbooks for phishing, triage, isolation, blocking, vulnerabilities and cloud containment, each verified on real devices.
Write and test Jinja templates in the browser
Write Jinja templates against live record data and see the rendered output as you type.
Threat feed ingestion template
Fetch-and-create skeleton for bulk-ingesting threat intel indicators.
Data ingestion template
Fetch / Create / Ingest skeleton for building a connector-based alert ingestion.
Ask an analyst before blocking
Pauses for analyst approval, then acts on the response.
Mailbox forwarding-rule triage
Investigates suspicious mailbox forwarding rules: audit history, current rules and directory lookups.
Set alert severity from AbuseIPDB score
Checks an alert's source IP against AbuseIPDB and raises severity when the abuse score is high.
IP reputation verdict with VirusTotal
Looks up an IP on VirusTotal and branches on the malicious-engine count.
Find and tag an existing indicator
Looks up an indicator by value and adds a tag to it.
Route alerts by severity
Branches high- and low-severity alerts down different paths.
Parent and child playbook pattern
Calls a child playbook with inputs and reads its result back.