FortiSOAR is designed to centralize, standardize, and automate security operations across both IT and OT, so you don’t have to run separate, disconnected processes. Here’s how it supports a converged environment:

• Single operations layer for IT and OT: FortiSOAR ingests alerts from your OT security tools (such as firewalls, IPS, NAC, EDR, log management, and specialized OT platforms like Armis, Claroty, Dragos, SCADAFence, and Everbridge) alongside your IT security stack. This gives your SOC or OT control center one place to monitor, investigate, and respond.
• Risk-based OT visibility: Dashboards are tailored for OT, including asset distribution, risk, and vulnerability status based on the Purdue model, plus tracking of open incidents, analyst activity, and response SLAs.
• Automation at scale: With 500+ integrations and 800+ prebuilt playbooks, FortiSOAR helps you automate alert triage, enrichment, and response across both IT and OT. This reduces manual work and helps address alert overload and analyst burnout.
• OT-specific content: You get OT-focused incident management, asset management, vulnerability management solution packs, OT threat intelligence management, and OT remediation playbooks, all aligned with frameworks like MITRE ATT&CK for ICS.
• Flexible deployment: You can deploy FortiSOAR on-premises, as SaaS, in the cloud, or via an MSSP, with the same feature set in each model.

In practice, this means you can extend your existing SOC to cover OT, or build out OT security operations that are tightly aligned with IT, without reinventing your processes from scratch.

FortiSOAR is built to help you reimagine OT security operations by automating repetitive tasks while keeping humans in the loop for higher-risk actions. Key OT automation use cases include:

• OT alert triage and incident handling
  • Automatically collect and normalize alerts from OT security products and ecosystem tools.
  • Enrich alerts with FortiGuard Labs threat intelligence and other public or OT-specific feeds.
  • Group related alerts into incidents and map them to the MITRE ATT&CK ICS framework.
  • Trigger prebuilt mitigation playbooks or launch a collaborative “war room” investigation.
• Risk-based vulnerability management for OT
  • Ingest OT vulnerability scanner results and prioritize them using the CISA risk-based framework.
  • Automatically categorize and assign remediation tasks.
  • Run end-to-end playbooks to patch or mitigate critical OT vulnerabilities.
• OT asset lifecycle and change management
  • Maintain an OT asset inventory with identification, criticality, vulnerability status, and alert status.
  • Automate standard asset changes and procedures, such as isolation steps or configuration updates.
• Threat intelligence management
  • Continuously curate and manage OT-relevant threat feeds from FortiGuard Labs and other standards-based sources.
  • Automatically apply new intelligence to enrich alerts and drive playbook decisions.
• Compliance and reporting
  • Automate advisory updates and compliance workflows for regulations such as GDPR, HIPAA, US BOD 22-01, and US NERC CIP.
  • Use built-in dashboards and tracking for SLAs, mandatory alerts, and required actions.

To balance automation with control, FortiSOAR supports permission-based actions. For example, a playbook can automatically investigate an OT alert, then pause and request analyst approval before executing steps like firewall rule changes or asset isolation. GenAI capabilities (FortiAI) further assist analysts by using natural language to help investigate threats, suggest responses, and build or refine playbooks without requiring coding skills.

FortiSOAR is designed so security and OT analysts—not just developers—can build and maintain automation. Here’s how it supports that:

• Low/no-code playbook design: A patented visual, drag-and-drop interface lets you design and modify playbooks without traditional coding. You can quickly assemble workflows for OT incident response, asset changes, or vulnerability handling.
• GenAI assistance (FortiAI): Analysts can use natural language to get help with threat investigations, response steps, and even playbook creation. This shortens the learning curve and speeds up iteration.
• Extensive content hub: The FortiSOAR Content Hub provides a large and growing library of:
  • Hundreds of connectors for security and OT ecosystem products
  • Prebuilt playbooks and complete solution packs for OT incident, asset, and vulnerability management
  • Dashboard widgets and best-practice templates
  You can start from these and adapt them to your environment instead of building from scratch.
• Community-driven enhancements: A moderated community portal gives you access to peer Q&A, shared content, and ideas from other users, along with direct interaction with Fortinet experts. This helps you keep your OT playbooks aligned with current practices and emerging threats.

Over time, this approach lets your team reimagine and refine OT workflows incrementally—starting with prebuilt content, then layering in your own logic and approvals as your maturity grows, without needing a dedicated software development function.