ORDERING GUIDE

FortiSOAR
Product Offerings

Available in:

Virtual Cloud
Machine (PaaS)

Product Information
FortiSOAR is a leading SOAR platform that is used in conjunction with SIEM, UEBA, EDR, or other
threat detection platforms. Use this document along with the FortiSOAR Datasheet to plan your
purchase and/or deployment. The following is a high-level mind map to enable you to quickly go
through all the various aspects that influence your purchase.

Deployment Options
FortiSOAR is available in various form factors ranging from customer-hosted on physical or
virtual platforms to Cloud hosting in platforms such as Amazon AWS, Microsoft Azure, Google
GCP, etc. In addition, FortiSOAR is available as a hosted offering wherein Fortinet hosts the
FortiSOAR instance in FortiCloud for the customer.

Licensing Model
At the heart of it, FortiSOAR licensing is based on two aspects:
1. User seats: Can be named or concurrent (count of users that require to simultaneously log in
to FortiSOAR at a given point in time).
2. The number of FortiSOAR nodes: Start with a single node and expand to more for HA/DR
requirements or simply scale out.
FortiSOAR is available in both the Subscription Licensing (pay yearly cost including support)
and the Perpetual Licensing (own the software, and pay support cost every year) models.

STRICTLY CONFIDENTIAL 1
ORDERING GUIDE | FortiSOAR

FortiSOAR is available in two editions:

1. Enterprise: Designed for accelerating self-managed SOC. Provides all the features except for
the ones that are designed for handling tenants or multiple SOCs.
2. Multi-Tenant: Primarily designed for Managed Service Providers offering SOCaaS and/or
Managed SOAR offerings. This model is also used by enterprises that have more than one
SOC and who require a dedicated SOAR for each of their SOCs as well as require the ability
to centrally manage all their SOCs.

Training Services
Fortinet offers courses geared towards the administration and design & development of
FortiSOAR. Refer to the following for additional details on the respective courses:
1. FortiSOAR Administrator
2. FortiSOAR Design and Development
Apart from self-paced training, you can also procure lab access via a scheduled instructor-led
training session, as well as vouchers for respective certifications.
Do not forget to leverage the FortiSOAR User Community for your day-to-day questions on
various aspects of FortiSOAR.

Professional Services
Automation is a journey, and we recognize that you would need different levels of support
during different phases of personalizing FortiSOAR for your organization:
1. JumpStart Program: This is typically a 10-15 days program that helps you set up FortiSOAR
using standardized best practices and getting you started with FortiSOAR, enabling you to
immediately realize the value of FortiSOAR.
2. Scoped Engagements: This is a customized SoW-based engagement for your tactical
needs ranging from ad-hoc assistance hours to specific needs such as building modules,
playbooks, integrations, etc.
3. Resident Engineer Program: This is a more strategic engagement to hire a dedicated SOAR
engineer for a 6 to 12 months duration.
Refer to FortiSOAR Services Catalogue for additional information.

Other Resources
FortiSOAR Platform Documentation: https://docs.fortinet.com/product/fortisoar
FortiSOAR Content Hub: https://fortisoar.contenthub.fortinet.com
FortiSOAR Connectors List: https://docs.fortinet.com/fortisoar/connectors
FortiSOAR Public Github: https://github.com/fortinet-fortisoar

STRICTLY CONFIDENTIAL 2
 ORDERING GUIDE | FortiSOAR

ORDER INFORMATION

DEPLOYMENT OPTIONS AND LICENSING MODEL

CUSTOMER HOSTED CUSTOMER HOSTED FORTINET HOSTED CLOUD

FORTISOAR EDITION
SUBSCRIPTION PERPETUAL SUBSCRIPTION
FortiSOAR Enterprise Edition FC-10-SRVMS-389-02-DD LIC-FSRENT-2 FC-10-SRCLD-385-02-DD*
FortiSOAR Enterprise Edition (Renewal) FC-10-SRVMS-385-02-DD
FortiSOAR Multi Tenant Edition - Master FC-10-SRVMS-390-02-DD LIC-FSRMTT-2 FC-10-SRCLD-386-02-DD*
FortiSOAR Multi Tenant Edition – Master (Renewal) FC-10-SRVMS-386-02-DD
Add User Seat FC-10-SRVMS-384-02-DD LIC-FSRAUL-1 FC-10-SRCLD-384-02-DD
Add Tenants on Master Included Included Included
Add Tenant as Dedicate SOAR Node (Single User Locked) - aka Dedicated
FC-10-SRVMS-387-02-DD LIC-FSRMTD-1 -
Tenant Node
Add Tenant as Dedicated SOAR Node (Multiple User Capable) - aka Regional
FC-10-SRVMS-388-02-DD LIC-FSRMTR-2 -
SOC Instance
Add Cloud Storage (1000GB with 8GB RAM and 4vCPU) FC1-10-SRCLD-584-01-DD
Add Health Monitoring using FortiMonitor FC2-10-MNCLD-437-01-DD **

SUPPORT SERVICES
FortiCare Premium Contract Included See Below Included
FortiCare BPS Included See Below Included
Support SKU for Perpetual Licensing Model
FortiCare Premium Contract for FortiSOAR Enterprise Edition - FC1-10-SRVMP-248-02-DD -
FortiCare Premium Contract for FortiSOAR Multi Tenant Edition - FC2-10-SRVMP-248-02-DD -
FortiCare Premium Contract for FortiSOAR Multi Tenant - Dedicated Tenant - FC3-10-SRVMP-248-02-DD -
FortiCare Premium Contract for FortiSOAR Multi Tenant - Regional SOC Instance - FC4-10-SRVMP-248-02-DD -
Support SKU with BPS for Perpetual Licensing Model
FortiCare Premium Contract for FortiSOAR Enterprise plus FortiCare BPS - FC1-10-SRVMP-338-02-DD -
FortiCare Premium Contract for FortiSOAR Multi Tenant plus FortiCare BPS - FC2-10-SRVMP-338-02-DD -
FortiCare Premium Contract for FortiSOAR Multi Tenant - Dedicated Tenant plus
- FC3-10-SRVMP-338-02-DD -
FortiCare BPS
FortiCare Premium Contract for FortiSOAR Multi Tenant - Regional SOC
- FC4-10-SRVMP-338-02-DD -
Instance plus FortiCare BPS

PROFESSIONAL SERVICES
Per Day Charge for Resource Service (SOW) FP-10-00000-M08-00-00
Per Hour Charge for Service Delivered After-Hours/Weekend. Must order a
FP-PS001-HR
minimum of 4 hours, and must use a minimum of 4 hours at a time
Custom Travel & Expenses for On Site Professional Services FP-MISC-TE
10/15 days JumpStart Programme and customised PS packages Ask for Quote based on specific requirements

TRAINING SERVICES
NSE 6 FortiSOAR Administration Training FT-FSR-ADM
NSE 6 FortiSOAR Administration Exam Voucher NSE-EX-SPL6
NSE 7 FortiSOAR Design & Development Training FT-FSR-DEV
NSE 7 FortiSOAR Design & Development Exam Voucher NSE-EX-CERT
NSE 7 FortiSOAR Design & Development Lab Access FT-FSR-DEV-LAB

* A FortiCloud Premium Account License (FC-15-CLDPS-219-02-DD) is required to use the FortiSOAR Cloud service.
** Recommended FortiMonitor’s 25-pack Device/Server Subscription Solution Bundle. For more information, see the FortiMonitor Data Sheet.

Sample BOQ

Customer 1:
An enterprise customer wants to host FortiSOAR within their premises. They need a perpetual license for 10 analysts along with 2 years of support. They also need training for developers along
with a development instance for ongoing playbook and connector creation:
• LIC-FSRENT-2 (FortiSOAR Enterprise Edition with 2 seats included - Perpetual)
• LIC-FSRAUL-8 (8 Additional User Seats)
• FC1-10-SRVMP-248-02-24 ( FortiCare Premium Contract for FortiSOAR Enterprise Edition for 24 months)
• FT-FSR-DEV (NSE 7 FortiSOAR Design & Development Training)
If PS is needed, a quote from PS team can be requested.

Customer 2:
An MSSP customer wants to leverage Fortinet’s Hosted Option and needs a license for 10 analysts. They also need training for their developers:
• FC-10-SRCLD-386-02-DD (FortiSOAR Hosted Cloud Subscription - Enterprise Edition with 2 seats and support included)
• FC-15-CLDPS-219-02-DD (FortiCloud Premium Account License)
• FT-FSR-DEV (NSE 7 FortiSOAR Design & Development Training)
If PS is needed, a quote from PS team can be requested.

3
STRICTLY CONFIDENTIAL
ORDERING GUIDE | FortiSOAR

FREQUENTLY ASKED QUESTIONS

I need more than one node for creating a highly available environment. Can I host FortiSOAR on Hypervisor or Cloud platform that is not listed
What all parts do I need to order? above?
Assuming that you need an enterprise edition in the Subscription mode with FortiSOAR has ready-made images available for VMware Hypervisor and
10 user seats, you would order: Amazon AWS AMI. For any other physical, virtual, or cloud hosting you can
1. 2 Qty of FortiSOAR Enterprise node – this includes 2 user seats per node install FortiSOAR on top of CentOS 7.x.
(additional node for HA) Is there any charge for using a connector?
2. 8 Qty of User Seats FortiSOAR does not impose any charge on installing/using a connector.
3. Support However please note that the target application (for example VirusTotal)
I need more information about Fortinet’s hosted deployment option. might need you to procure their service/API, etc. for being consumed by the
connector.
Refer to FortiCloud Datasheet: https://www.fortinet.com/content/dam/
fortinet/assets/data-sheets/FortiCloud.pdf What are my options to build a new connector, or enhance an existing
connector?
I am not an MSSP; is there a scenario where the multi-tenant edition would
be more beneficial for me? Option 1 – FortiSOAR provides full IDE to build, test, and publish connectors.
Leverage that to build a new or enhance an existing connector. You can also
Indeed! Some of our big customers leverage FortiSOAR’s Multi-Tenant edition
submit the one that you built to the FortiSOAR Community.
for unifying their multi-SOC operations and embracing the diversity of how
their SOCs are designed differently (different tools as well as different See the instructions here: https://github.com/fortinet-fortisoar/how-tos
processes).
Option 2 – Request your Account Manager to create a task for FortiSOAR R&D
What does concurrent user mean? How does it benefit the customer?
to build the connector. The success of this option is dependent on various
FortiSOAR does not impose any restrictions on creating a user. Technically, aspects, some of which are:
your entire organization can log in to FortiSOAR. The only restriction is how
• Access/Availability of target application to Test
many of them can log in at the same time (aka concurrently).
• Access/Availability of target application’s API
This model comes in handy for optimizing the number of user licenses you
need. For example, let’s assume you have 2 admins and 30 analysts across 3 • Demand for the desired integration
shifts. In this case, you could reduce the number of seats to 12 (2 reserved Several such criteria would be applied by the FortiSOAR PM to decide the
for admins and 10 floating amongst the analysts). timeline of delivery for the requested integration

Do I need to buy a node for playbook/connector development work?

Option 3 – Leverage FortiSOAR Professional Services (PS) to quickly build the
You can leverage the FortiSOAR Trial license for such dev/test work. The
integration scoped to your needs. This option requires you to purchase PS
FortiSOAR Trial license is perpetually valid and allows 3 user accounts as well
and it is likely to have the fastest turnaround time. It is suitable if you urgently
as 200 playbook actions every day.
need an integration that is not on the store.

www.fortinet.com

Copyright © 2022 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product
or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other
conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser
that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any
such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise
revise this publication without notice, and the most current version of the publication shall be applicable.

FSR-OG-R6-20220816
STRICTLY CONFIDENTIAL