Sample Alerts and Incidents (C): The content pack includes a set of demo records. Upon installation and clicking the "Demo IR Records" button, the system populates the Alerts and Incidents modules with pre-configured samples, including associated indicators and assets, to demonstrate how records are handled.
System Playbooks (D): It installs a comprehensive collection of "out-of-the-box" (OOB) playbooks. These include system-level playbooks used for triaging, indicator extraction, and managing standard record lifecycles (such as auto-populating dates when a record is closed).
Sample Data for Playbooks (B): Along with the records themselves, the pack includes simulation and training data (often referred to as "Playbook Samples" or "Mock Data"). This allows administrators to test playbook logic and workflows without requiring live feeds from third-party security tools.

Creating a user in FortiSOAR requires assigning at least one role for permissions, providing a valid email for identification and notifications, and associating the user with at least one team for proper access and workflow participation.

The Forward Leaning stage focuses on enhancing efficiency and optimizing productivity through increased automation, orchestration, and process refinement.

Administrators can collect and review FortiSOAR logs for troubleshooting in two primary ways.
First, they can download logs directly from the GUI, which provides access to various logs through an intuitive interface. Secondly, using the command-line interface, the csacta log --collect command can be used to gather all logs within a specified directory, enabling more detailed offline analysis. Both methods offer comprehensive log collection to aid in diagnosing and resolving issues.

In FortiSOAR playbooks, the "Create Record" and "Update Record" steps are categorized under the "Core" category of playbook steps. Core steps are essential actions that are frequently used in playbooks to interact with records in the FortiSOAR database. They include fundamental operations such as creating, reading, updating, or deleting records within modules. These steps are crucial for the automation of tasks such as data management, where playbooks need to create new entries or update existing data as part of incident response workflows.