WEBVTT

1
00:00.000 --> 00:04.000
To wrap up this set of videos regarding 40 analyzer and playbooks,

2
00:04.000 --> 00:06.880
I'd like to present this scenario where we have a company that you're

3
00:06.880 --> 00:08.000
consulting for

4
00:08.000 --> 00:12.000
and they want to begin using automation, aka playbooks,

5
00:12.000 --> 00:16.000
with their 40 analyzer. So here's what I'd like you to do. I'd like you to

6
00:16.000 --> 00:16.000
think,

7
00:16.000 --> 00:20.000
before we go talk to the customer, what are the main components of playbooks

8
00:20.000 --> 00:24.000
that makes it all possible and perhaps what's an example or two of

9
00:24.000 --> 00:28.000
how playbooks can help make their life easier in managing and maintaining

10
00:28.000 --> 00:32.000
their environment. So go ahead and pause me now, give that some thought,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.000 --> 00:32.000
their environment. So go ahead and pause me now, give that some thought,

11
00:32.000 --> 00:36.000
and when you're ready, click on 'em resume and we'll take a look at this

12
00:36.000 --> 00:36.000
together.

13
00:36.000 --> 00:40.000
Alright, and welcome back.

14
00:40.000 --> 00:44.000
So, in preparation for talking with our customer, I probably also want to

15
00:44.000 --> 00:48.000
remind them of some of the benefits of using automation and playbooks

16
00:48.000 --> 00:52.000
on the 40 analyzer. So as far as what can be automated, we can

17
00:52.000 --> 00:56.000
automate incident response, including the creation of an incident

18
00:56.000 --> 01:00.000
based on a certain category of events that are identified by the event handlers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:56.000 --> 01:00.000
based on a certain category of events that are identified by the event handlers

19
01:00.000 --> 01:04.000
on the 40 analyzer. So automatically we have incidents created

20
01:04.000 --> 01:08.000
based on the types of events our 40 analyzer is seeing, and then

21
01:08.000 --> 01:12.000
populate those incidents with relevant information, which is going to make it a

22
01:12.000 --> 01:12.000
lot easier

23
01:12.000 --> 01:16.000
and faster to respond and work with those incidents. Another big benefit

24
01:16.000 --> 01:20.000
of automation is consistency. And that way, it's done in the same way,

25
01:20.000 --> 01:24.000
the same manner every time, and we don't forget some steps. So if a playbook

26
01:24.000 --> 01:28.000
has like 20 or 30 steps in it or tasks in it, if we run the playbook,

27
01:28.000 --> 01:32.000
those are all going to run, assuming they complete successfully, and we don't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.000 --> 01:32.000
those are all going to run, assuming they complete successfully, and we don't

28
01:32.000 --> 01:32.000
have

29
01:32.000 --> 01:35.680
to worry about forgetting this or forgetting that because it's kind of baked

30
01:35.680 --> 01:36.000
into an automated

31
01:36.000 --> 01:40.000
playbook. That's also going to end up in saving time, because if we can

32
01:40.000 --> 01:44.000
you know, click a button or have the system automatically do 15 tasks for us,

33
01:44.000 --> 01:47.990
we don't have to manually do them. And that's going to decrease the time it

34
01:47.990 --> 01:48.000
takes to

35
01:48.000 --> 01:52.000
do that and allow more time for us to focus on other things. Another benefit

36
01:52.000 --> 01:55.440
is we are going to have better documentation, because if we're running play

37
01:55.440 --> 01:56.000
books,

38
01:56.000 --> 01:59.010
whether they're manually triggered or they're triggered by incidents or they're

39
01:59.010 --> 02:00.000
triggered based on events,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:59.010 --> 02:00.000
triggered based on events,

40
02:00.000 --> 02:04.000
if part of those playbooks include creating reports, we're going to have that

41
02:04.000 --> 02:08.100
documentation consistently based on that playbook running. Another benefit is

42
02:08.100 --> 02:08.880
because of all the

43
02:08.880 --> 02:13.010
connectors 40 analyzer has, it can integrate with a lot of other products,

44
02:13.010 --> 02:14.320
including most of the

45
02:14.320 --> 02:20.350
fordnet products and others, like MS teams or Slack or vSphere and other third

46
02:20.350 --> 02:20.960
party vendors.

47
02:20.960 --> 02:24.490
So another benefit is integration. So regarding what are the main components of

48
02:24.490 --> 02:25.280
playbooks,

49
02:25.280 --> 02:28.960
let's talk about that next. So the main components regarding playbooks would be

50
02:28.960 --> 02:29.840
the connectors.

51
02:29.840 --> 02:33.700
So the connector to itself is called the local connector. The connector to 40
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:29.840 --> 02:33.700
So the connector to itself is called the local connector. The connector to 40

52
02:33.700 --> 02:34.560
gate firewalls is

53
02:34.560 --> 02:38.640
the 40 OS. The connector out to FortiGuard service in the cloud is the Forti

54
02:38.640 --> 02:39.760
Guard connector. And so

55
02:39.760 --> 02:44.190
the connectors are a major component regarding the automation of the 40 analy

56
02:44.190 --> 02:45.840
zer with other devices.

57
02:45.840 --> 02:50.160
Another big element of playbooks would be the triggers. And as we mentioned,

58
02:50.160 --> 02:50.720
there's four

59
02:50.720 --> 02:54.740
types of triggers. There's manual where we launch it manually ourselves. We can

60
02:54.740 --> 02:55.680
have it based on

61
02:55.680 --> 03:00.530
event criteria or incident criteria, or we can also set up a schedule as a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:55.680 --> 03:00.530
event criteria or incident criteria, or we can also set up a schedule as a

62
03:00.530 --> 03:01.920
trigger. So it happens

63
03:01.920 --> 03:06.330
every 10 minutes or every day, etc. And think of the trigger like kicking off

64
03:06.330 --> 03:07.120
the playbook,

65
03:07.120 --> 03:10.960
telling all those tasks associated with the playbook to start running. And that

66
03:10.960 --> 03:11.280
leads me

67
03:11.280 --> 03:15.470
to another big part of our playbooks. And that would be the actions or the

68
03:15.470 --> 03:16.640
tasks. And for actions

69
03:16.640 --> 03:20.600
and tasks, they can go like this, like I want to run these two next

70
03:20.600 --> 03:22.720
simultaneously, or we could say

71
03:22.720 --> 03:26.270
I want to run this task, and then I want to run this task, and then I want to

72
03:26.270 --> 03:27.120
run this task.

73
03:27.120 --> 03:31.690
And the output of one task, for example, gathering event information can be the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:27.120 --> 03:31.690
And the output of one task, for example, gathering event information can be the

74
03:31.690 --> 03:32.720
input for the next

75
03:32.720 --> 03:36.660
task. So maybe this task right here is gather event information regarding this

76
03:36.660 --> 03:37.600
type or that type

77
03:37.600 --> 03:42.100
for the last 60 minutes, and then include them inside the incident. So this

78
03:42.100 --> 03:43.040
part would be getting

79
03:43.040 --> 03:46.490
the information. And this part would be adding it to the incident. I also want

80
03:46.490 --> 03:47.360
to point out that

81
03:47.360 --> 03:52.970
on a 40 analyzer without the correct licensing, isn't going to have full access

82
03:52.970 --> 03:54.160
to all the automation

83
03:54.160 --> 03:59.190
capabilities. So we need the connectors in place, and we also need appropriate

84
03:59.190 --> 04:00.160
licensing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:59.190 --> 04:00.160
licensing.

85
04:00.160 --> 04:03.680
So while we're here, let me show you that as well. We go to dashboards and

86
04:03.680 --> 04:04.480
status. Here is the

87
04:04.480 --> 04:07.650
license information. I'll make that a little bit bigger. So we're here in the

88
04:07.650 --> 04:08.800
licensing information

89
04:08.800 --> 04:12.880
here for security automation. Without that, we're not going to have all the

90
04:12.880 --> 04:13.920
functionality we would

91
04:13.920 --> 04:17.870
want regarding automation will have some, but not everything. So who on all the

92
04:17.870 --> 04:18.720
bells and whistles

93
04:18.720 --> 04:22.750
available to us, we're going to want the security automation licensing in

94
04:22.750 --> 04:24.240
conjunction with our 40

95
04:24.240 --> 04:27.960
analyzer. So I've had a lot of fun in this set of videos in the skill regarding

96
04:27.960 --> 04:29.040
40 analyzer and

97
04:29.040 --> 04:32.770
playbooks. And I look forward to seeing you my friend in another set of videos
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:29.040 --> 04:32.770
playbooks. And I look forward to seeing you my friend in another set of videos

98
04:32.770 --> 04:33.840
very, very soon.

99
04:33.840 --> 04:38.860
Until then, I hope this has been informative and I'd like to thank you for

100
04:38.860 --> 04:39.520
viewing.