Securing the Modern Workspace
July 29, 2025
How to Win DLP Buy-In and Influence Stakeholders
August 4, 2025FortiSIEM 7.4 Turbocharges Incident Management with Native SOAR Automation
Security operations centers (SOCs) are under increasing pressure to detect and respond to threats faster with greater accuracy and efficiency. The latest release of FortiSIEM, version 7.4, takes a significant leap forward in addressing those demands, introducing native SOAR automation, GenAI-driven investigations, richer dashboard visualizations, and federated data lake search.
Whether you’re already using FortiSIEM or evaluating a next-gen SIEM platform, 7.4 delivers powerful new capabilities to transform your SOC operations.
FortiSIEM 7.4 Delivers New Advanced Features
FortiSIEM 7.4 introduces several powerful enhancements that elevate the platform’s core capabilities to streamline workflows, boost analyst efficiency, and improve visibility across complex environments. Key highlights include:
- Built-in SOAR automation capabilities powered by FortiSOAR
- Greatly expanded visualizations and dashboarding capabilities
- Enhanced FortiAI-Assist GenAI capabilities for guided search
- Federated search across popular data lake technologies
Whether you’re a current user or in the market for a proven solution, read on to see how this latest release of FortiSIEM delivers on the promise of a next-gen SIEM platform.
Native SOAR Automation
FortiSIEM now unites the power of FortiSIEM and FortiSOAR into a single SIEM solution, bringing the simplicity and power of SOAR automation to any FortiSIEM activity. With an automated analyst experience, prebuilt playbook library, and simple playbook creation, the power of automation will turbocharge threat investigation and response and any analyst activity.
Contextual playbook access and prompting are available throughout typical workflows, with playbooks triggered automatically, manually, or by schedule. This new FortiSIEM automation option is completely consumed and managed natively within FortiSIEM. Powered by a FortiSOAR cloud service, FortiSIEM gives users access to the robust capabilities and 680+ connectors supported by FortiSOAR.
The FortiSIEM automation capability and playbook library will continually expand over future product releases. Playbook library coverage includes:
- Incident Investigation
- Incident Enrichment
- Incident Remediation
- Attack Response
- Threat Hunting
- Forensic Analysis
- Phishing Processing
Note: This feature is in beta, with planned availability in early Q3 2025. Contact your Fortinet or partner account manager for updates.
Rich Visualizations and Dashboards
FortiSIEM now includes a new dashboard framework with expanded visualizations, flexible placement, full drill-down capabilities, and simple report editing. Over a dozen standard dashboards have already been enhanced to take full advantage of these new capabilities.
FortiSIEM 7.4 also includes two new standard dashboards useful to any organization:
- Situation Dashboard – Provides a complete overview of your security posture, including risk levels and trends, active incidents, and operations efficiency metrics
- Operations Dashboard – Delivers system visibility and status metrics on areas including Agents, Collectors, active data sources, storage consumption, and system performance
Note: This feature is in beta, with planned availability in early Q3 2025. Contact your Fortinet or partner account manager for updates.
Federated Data Lake Search
FortiSIEM also supports querying a variety of external data lakes, providing broad analytics capabilities to query and join data within the FortiSIEM data lake to improve investigations and threat hunting capabilities.
Ancillary supported data lakes include:
- AWS S3
- Google GCS
- Azure Blob and Data Lake
- ODBC-compliant databases such as Snowflake and SQL variants
- CSV, JSON, or Parquet file formats
Note: This feature is available for customer preview until its official release later in 2025.
Additional New Features
- FortiAI-Assist Support for Azure OpenAI: Customers can now choose between standard OpenAI GPT and Azure OpenAI as the backend LLM for the FortiSIEM FortiAI-Assist co-pilot.
- Natural Language Guided Queries: FortiAI-Assist GenAI has been expanded to allow interactive natural language to build and validate queries, greatly simplifying and speeding analyst investigations and threat hunting.
- Analytical Result Analysis: FortiAI-Assist can now perform statistical analysis on the results of analytical queries and reports to help analysts identify anomalies.
- Incident Tagging and Playbook Associations: FortiSIEM detection rules are now pre-tagged, allowing new capabilities such as pre-filtered playbook suggestions for analysts.
- New Regional SaaS Locations: FortiSIEM Cloud is now available in four new regions, Brazil, Italy, South Africa, and the UAE, enlarging its worldwide footprint to 19 regions.
- Expanded Parser Integrations: The latest release includes updates to over 18 integrations, plus four new integrations for FortiCNAPP, FortiDLP, Omicron, and Barracuda Email. In addition, customers can create playbooks using the 680+ SOAR connectors available via the FortiSIEM Automation Service.
Experience FortiSIEM 7.4 Today
FortiSIEM 7.4 isn’t just another update; it represents a major milestone in converging SIEM and SOAR into a unified, automated, and AI-accelerated platform. By integrating automation, visual clarity, federated analytics, and GenAI-assisted operations, FortiSIEM empowers SOC teams to move faster, act smarter, and defend better.
