Browse

AWS EC2 (Extended)

Call any EC2 API action, including all-protocol rules

A clone of the AWS EC2 connector that adds a generic boto3 passthrough operation, so any AWS API action can be called without waiting for a curated operation…

Generic HTTP

Call any HTTP API with shared auth and paging

Call any REST API with absolute URLs, auth set once in the configuration, and automatic paging.

SOC Report

Display the FortiManager SOC report on a record

Display the FortiManager SOC report inside a record view.

Firewall Owner Dashboard

Give firewall owners a dashboard of their devices and policies

A dashboard for firewall owners: device status, policy hit counts and announcements in one view.

ZTP Automation Step Graph

Graph each device's automation steps

Renders a Cytoscape.js node graph of a ZTP device's automation-step run-group (ztpf_device_automation_steps), ordered by step number ascending.

FortiGate Cloud

Manage cloud-managed firewalls, report schedules and backups

Add and manage devices, schedule reports, set config auto-backup, and call the FortiOS API through FortiGate Cloud.

Horizon3.ai

Pull autonomous pentest findings and weaknesses

Pull NodeZero pentest results, weaknesses and affected hosts into your playbooks.

Fortinet FortiSIEM v2

Query, investigate and ingest SIEM incidents

Query events and the CMDB, investigate incidents asynchronously, and ingest incidents natively.

Action Renderer

Render playbook actions on a record view

Configure a connector action or playbook on the edit panel; the widget executes it on the view panel against the current record (params can use Jinja for…

ZTP Run Report

Report on ZTP runs by run group, device and step

Run-group-first ZTP dashboard: a narrative headline, per-device and per-step results, and charts.

Ansible Automation

Run Ansible playbooks, modules and roles

Executes Ansible playbooks, ad-hoc modules, and roles directly from FortiSOAR playbooks using ansible-runner, returning structured per-host and per-task…

Code Runner (Unrestricted)

Run unrestricted Python from a playbook step

Execute Python snippets with no sandbox restrictions: top-level return works and open()/filesystem access is available.

SMTP (Next-Gen)

Send email with templates and attachments

Send email via SMTP (stdlib smtplib, pydantic-validated, returns a structured result).

ZTP Group Timer

Show live elapsed time for a ZTP run group

A live count-up clock for one ZTPF run group.

Verified response playbooks for common SOC use cases

Ten playbooks for phishing, triage, isolation, blocking, vulnerabilities and cloud containment, each verified on real devices.

Jinja Editor

Write and test Jinja templates in the browser

Write Jinja templates against live record data and see the rendered output as you type.

Threat feed ingestion template

Fetch-and-create skeleton for bulk-ingesting threat intel indicators.

Data ingestion template

Fetch / Create / Ingest skeleton for building a connector-based alert ingestion.

Ask an analyst before blocking

Pauses for analyst approval, then acts on the response.

Mailbox forwarding-rule triage

Investigates suspicious mailbox forwarding rules: audit history, current rules and directory lookups.

Set alert severity from AbuseIPDB score

Checks an alert's source IP against AbuseIPDB and raises severity when the abuse score is high.

IP reputation verdict with VirusTotal

Looks up an IP on VirusTotal and branches on the malicious-engine count.

Find and tag an existing indicator

Looks up an indicator by value and adds a tag to it.

Route alerts by severity

Branches high- and low-severity alerts down different paths.

Parent and child playbook pattern

Calls a child playbook with inputs and reads its result back.