To wrap up this set of videos regarding 40 analyzer and playbooks,
I'd like to present this scenario where we have a company that you're
consulting for
and they want to begin using automation, aka playbooks,
with their 40 analyzer. So here's what I'd like you to do. I'd like you to
think,
before we go talk to the customer, what are the main components of playbooks
that makes it all possible and perhaps what's an example or two of
how playbooks can help make their life easier in managing and maintaining
their environment. So go ahead and pause me now, give that some thought, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
their environment. So go ahead and pause me now, give that some thought,
and when you're ready, click on 'em resume and we'll take a look at this
together.
Alright, and welcome back.
So, in preparation for talking with our customer, I probably also want to
remind them of some of the benefits of using automation and playbooks
on the 40 analyzer. So as far as what can be automated, we can
automate incident response, including the creation of an incident
based on a certain category of events that are identified by the event handlers WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
based on a certain category of events that are identified by the event handlers
on the 40 analyzer. So automatically we have incidents created
based on the types of events our 40 analyzer is seeing, and then
populate those incidents with relevant information, which is going to make it a
lot easier
and faster to respond and work with those incidents. Another big benefit
of automation is consistency. And that way, it's done in the same way,
the same manner every time, and we don't forget some steps. So if a playbook
has like 20 or 30 steps in it or tasks in it, if we run the playbook,
those are all going to run, assuming they complete successfully, and we don't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those are all going to run, assuming they complete successfully, and we don't
have
to worry about forgetting this or forgetting that because it's kind of baked
into an automated
playbook. That's also going to end up in saving time, because if we can
you know, click a button or have the system automatically do 15 tasks for us,
we don't have to manually do them. And that's going to decrease the time it
takes to
do that and allow more time for us to focus on other things. Another benefit
is we are going to have better documentation, because if we're running play
books,
whether they're manually triggered or they're triggered by incidents or they're
triggered based on events, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
triggered based on events,
if part of those playbooks include creating reports, we're going to have that
documentation consistently based on that playbook running. Another benefit is
because of all the
connectors 40 analyzer has, it can integrate with a lot of other products,
including most of the
fordnet products and others, like MS teams or Slack or vSphere and other third
party vendors.
So another benefit is integration. So regarding what are the main components of
playbooks,
let's talk about that next. So the main components regarding playbooks would be
the connectors.
So the connector to itself is called the local connector. The connector to 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the connector to itself is called the local connector. The connector to 40
gate firewalls is
the 40 OS. The connector out to FortiGuard service in the cloud is the Forti
Guard connector. And so
the connectors are a major component regarding the automation of the 40 analy
zer with other devices.
Another big element of playbooks would be the triggers. And as we mentioned,
there's four
types of triggers. There's manual where we launch it manually ourselves. We can
have it based on
event criteria or incident criteria, or we can also set up a schedule as a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event criteria or incident criteria, or we can also set up a schedule as a
trigger. So it happens
every 10 minutes or every day, etc. And think of the trigger like kicking off
the playbook,
telling all those tasks associated with the playbook to start running. And that
leads me
to another big part of our playbooks. And that would be the actions or the
tasks. And for actions
and tasks, they can go like this, like I want to run these two next
simultaneously, or we could say
I want to run this task, and then I want to run this task, and then I want to
run this task.
And the output of one task, for example, gathering event information can be the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the output of one task, for example, gathering event information can be the
input for the next
task. So maybe this task right here is gather event information regarding this
type or that type
for the last 60 minutes, and then include them inside the incident. So this
part would be getting
the information. And this part would be adding it to the incident. I also want
to point out that
on a 40 analyzer without the correct licensing, isn't going to have full access
to all the automation
capabilities. So we need the connectors in place, and we also need appropriate
licensing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
licensing.
So while we're here, let me show you that as well. We go to dashboards and
status. Here is the
license information. I'll make that a little bit bigger. So we're here in the
licensing information
here for security automation. Without that, we're not going to have all the
functionality we would
want regarding automation will have some, but not everything. So who on all the
bells and whistles
available to us, we're going to want the security automation licensing in
conjunction with our 40
analyzer. So I've had a lot of fun in this set of videos in the skill regarding
40 analyzer and
playbooks. And I look forward to seeing you my friend in another set of videos WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
playbooks. And I look forward to seeing you my friend in another set of videos
very, very soon.
Until then, I hope this has been informative and I'd like to thank you for
viewing.