Fortinet NSE 5 and NSE 6 in Security Operations
Fortinet security operations (NSE 5-6)
Professional-level course
Preparation for the NSE 5 and NSE 6 certifications in Security Operations, on the three platforms a Fortinet SOC runs on - the FortiAnalyzer, FortiSIEM and FortiSOAR platforms. Participants leave able to collect and analyse the logs, work an incident from event to closure, and build the playbooks that run the routine automatically.
- Registration
- Waiting list
- Duration
- 48 academic hours
- Format
- In personHybrid
- Level
- Professional
- Certification
- Fortinet NSE 5 and NSE 6 in Security Operations
- Language
- Hebrew, course materials in English
- For organisations
- 8 intensive days - at the academy or hybrid
What you will be able to do
- Connect FortiGate firewalls to a FortiAnalyzer platform and follow the log data flow - collection, normalization and parsing.
- Analyse logs, events and incidents on FortiView dashboards and widgets.
- Write event handlers, open incidents with their indicators, and run playbooks and Fabric automation.
- Build reports from charts and datasets and fix a report that does not generate.
- Correlate events from many sources on a FortiSIEM platform and work an incident as the analyst.
- Automate the response with playbooks on a FortiSOAR platform.
The syllabus
7 modules over 48 academic hours. Open a module for its topics.
- Fabric integration and log collection
- Log data flow, normalization and parsing
- The SOC features on the FortiAnalyzer platform
- Logs, events and incidents
- FortiView dashboards and widgets
- Diagnosing report generation issues
- Events and event handlers
- Incidents and indicators
- Playbooks and Fabric automation
- Troubleshooting playbook and Fabric automation issues
- Reports, charts and datasets
- Configuring reports
- Troubleshooting report generation
- Bringing the log sources into the FortiSIEM platform
- Correlating events from different sources into incidents
- Investigating an incident from the console
- The scope of the Fortinet NSE 6 - FortiSIEM Analyst exam
- Alerts and incidents on the FortiSOAR platform
- Building playbooks that enrich, decide and act
- The scope of the Fortinet NSE 6 - FortiSOAR Analyst exam
- An active NSE 4 as the base, then NSE 5 with the FortiAnalyzer Analyst exam
- NSE 6 with the FortiSIEM Analyst exam or the FortiSOAR Analyst exam
- Booking at Pearson VUE, at a test centre or through OnVUE, and the two-year validity
Who it is for
Who takes this course, and what you need before the first session.
SOC analysts in an organisation that runs Fortinet
FortiGate administrators moving from the firewall to monitoring and response
Teams setting up a SOC or an MSSP service on the Fortinet platforms
Prerequisites
NSE 5 and NSE 6 in Security Operations are awarded only on an active NSE 4; for the course, hands-on experience with a FortiGate firewall - Fortinet recommends 6 months to 1 year with the FortiGate and FortiAnalyzer platforms.
The exam and the certification
Two exams, both in English and both booked through Pearson VUE, at a test centre or online through OnVUE. NSE 5 in Security Operations is earned with Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst - 30-35 questions in 65 minutes. NSE 6 in Security Operations is earned with Fortinet NSE 6 - FortiSIEM 7.4 Analyst - 35-40 questions in 70 minutes - or with Fortinet NSE 6 - FortiSOAR 7.6 Analyst. Each certification is awarded on an active NSE 4 and is valid for two years. We help with the booking.
The certification
Fortinet NSE 5 and NSE 6 in Security Operations
How it is sat
Through Pearson VUE, in English - at a test centre, or online with OnVUE for the NSE 4, 5 and 6 exams. NSE 7 exams are test-centre only from September 21, 2026.
Validity
Two years, like every Fortinet certification. NSE 5 and NSE 6 need an active NSE 4; passing NSE 7 renews NSE 1-4 and the NSE 5 or NSE 6 in the same track.
Retakes
A failed exam can be retaken after 15 days.
Where this course sits on the Fortinet ladder. The lit rung is the one it prepares for; the whole path, with what each level requires, is on the Fortinet track page.
- NSE 1-3 Cybersecurity fundamentals - free self-paced courses
- NSE 4 FortiOS Administrator
- NSE 5 Specialisation in a range of subjects, at Professional level Preparation at the academy
- NSE 6 Specialisation in a range of subjects, at Professional level Preparation at the academy
- NSE 7 Specialisation in a range of subjects, at an advanced level
- NSE 8 Cybersecurity Expert
The labs
The FortiGate firewalls from the academy's rack send their logs to the FortiAnalyzer, FortiSIEM and FortiSOAR lab environments of the course, which you configure yourselves - handlers, incidents, playbooks and reports - with Windows Server and Linux hosts in the virtual lab as extra log sources. Incidents are worked end to end on data you generated yourselves.
Two ways to take the course
The waiting list for the next open cohort, or an intensive format for a team - which a team can have on its own dates, whatever the open cohorts are doing.
The next cohort
The next cohort is in planning - 48 academic hours at the academy in Shoham. A hybrid option is available, with part of the sessions remote. Join the waiting list and you hear the dates first; the list is also what decides which course opens next.
For your team
8 intensive days - at the academy in Shoham, or hybrid with part of the sessions remote. Small groups, and a syllabus adjusted to your equipment and environment.
Related courses
Professional
Registering now
FortiGate firewall administration (NSE 4)
Preparation for the NSE 4 certification - configuring, operating and troubleshooting a FortiGate firewall on real appliances in the lab. Participants leave able to run a FortiGate firewall on their own: policies, NAT, user authentication, content inspection, routing, IPsec VPN and a high-availability cluster.
Explore Associate Opening soonSOC Analyst, Tier 1-2
A course that trains a SOC analyst to work the SIEM on Splunk - reading alerts, triaging and enriching them, and handling an incident from the first sign to closure. Graduates can tell a real incident from a false positive, investigate it and pass it on to Tier 2, and sit prepared for the Splunk, CompTIA and Microsoft SOC certification exams.
Explore
Specialist
Opening soon
Fortinet secure networking architect (NSE 7)
Preparation for the NSE 7 certification in Secure Networking - the enterprise-scale deployment of FortiGate, FortiManager and FortiAnalyzer platforms, along the five sections of the published exam. Participants leave able to design and run a multi-site Fortinet estate: SD-WAN with zero-touch branches, central management, dynamic routing and advanced IPsec.
Explore