Browse

Admin utilities: playbook references, connector audit, module clone

Find which playbooks call a given playbook, list the connectors a playbook needs, and clone a module with its fields and layouts.

API helper playbooks for FortiGate and FortiManager

Reusable sub-playbooks that call the FortiGate REST and FortiManager JSON-RPC APIs with a username and password, no connector needed.

AWS EC2 (Extended)

Call any EC2 API action, including all-protocol rules

A clone of the AWS EC2 connector that adds a generic boto3 passthrough operation, so any AWS API action can be called without waiting for a curated operation…

Generic HTTP

Call any HTTP API with shared auth and paging

Call any REST API with absolute URLs, auth set once in the configuration, and automatic paging.

C3 Charts

Chart widget for dashboards and record views

Bar, line, pie and donut charts built on C3.js, configurable from the widget editor.

SOC Report

Display the FortiManager SOC report on a record

Display the FortiManager SOC report inside a record view.

Example playbooks for each built-in AI agent

One playbook per built-in FortiSOAR 8.0 AI agent, each asking it a question about an alert and saving the answer as a comment.

Extract IOCs from alert attachments

Extracts indicators from files attached to an alert, creates indicator records and sends the analyst-approved ones to block.

Fleet-wide IP blocking with a FortiManager threat feed

Creates an IP threat feed on FortiManager and keeps it filled with malicious indicators raised by FortiNDR and FortiEDR alerts.

Firewall Owner Dashboard

Give firewall owners a dashboard of their devices and policies

A dashboard for firewall owners: device status, policy hit counts and announcements in one view.

ZTP Automation Step Graph

Graph each device's automation steps

Renders a Cytoscape.js node graph of a ZTP device's automation-step run-group (ztpf_device_automation_steps), ordered by step number ascending.

Inoreader

Inoreader feeds and article streams

Connector that pulls RSS and Atom feeds, article streams and saved searches from Inoreader.

Isolate OT devices on a FortiGate

Moves an OT or IoT asset into an isolation address group on a FortiGate and releases it after approval.

FortiGate Cloud

Manage cloud-managed firewalls, report schedules and backups

Add and manage devices, schedule reports, set config auto-backup, and call the FortiOS API through FortiGate Cloud.

Playbook tutorial pack

Thirty example playbooks for learning FortiSOAR: Jinja and data handling, playbook basics, and integration patterns.

Horizon3.ai

Pull autonomous pentest findings and weaknesses

Pull NodeZero pentest results, weaknesses and affected hosts into your playbooks.

Fortinet FortiSIEM v2

Query, investigate and ingest SIEM incidents

Query events and the CMDB, investigate incidents asynchronously, and ingest incidents natively.

Recover FortiGates that drop off FortiManager

Finds FortiGates missing from FortiManager, re-adds deleted ones, authorizes pending ones and reinstalls their policy package.

Action Renderer

Render playbook actions on a record view

Configure a connector action or playbook on the edit panel; the widget executes it on the view panel against the current record (params can use Jinja for…

ZTP Run Report

Report on ZTP runs by run group, device and step

Run-group-first ZTP dashboard: a narrative headline, per-device and per-step results, and charts.

Ansible Automation

Run Ansible playbooks, modules and roles

Executes Ansible playbooks, ad-hoc modules, and roles directly from FortiSOAR playbooks using ansible-runner, returning structured per-host and per-task…

Code Runner (Unrestricted)

Run unrestricted Python from a playbook step

Execute Python snippets with no sandbox restrictions: top-level return works and open()/filesystem access is available.

SMTP (Next-Gen)

Send email with templates and attachments

Send email via SMTP (stdlib smtplib, pydantic-validated, returns a structured result).

ZTP Group Timer

Show live elapsed time for a ZTP run group

A live count-up clock for one ZTPF run group.

Verified response playbooks for common SOC use cases

Ten playbooks for phishing, triage, isolation, blocking, vulnerabilities and cloud containment, each verified on real devices.

Jinja Editor

Write and test Jinja templates in the browser

Write Jinja templates against live record data and see the rendered output as you type.

Threat feed ingestion template

Fetch-and-create skeleton for bulk-ingesting threat intel indicators.

Data ingestion template

Fetch / Create / Ingest skeleton for building a connector-based alert ingestion.

Ask an analyst before blocking

Pauses for analyst approval, then acts on the response.

Mailbox forwarding-rule triage

Investigates suspicious mailbox forwarding rules: audit history, current rules and directory lookups.

Set alert severity from AbuseIPDB score

Checks an alert's source IP against AbuseIPDB and raises severity when the abuse score is high.

IP reputation verdict with VirusTotal

Looks up an IP on VirusTotal and branches on the malicious-engine count.

Find and tag an existing indicator

Looks up an indicator by value and adds a tag to it.

Route alerts by severity

Branches high- and low-severity alerts down different paths.

Parent and child playbook pattern

Calls a child playbook with inputs and reads its result back.