Fortinet's SOAR platform, sold as SaaS or self-managed software with enterprise and multi-tenant options. Pages here cover replacing it with self-hosted Shuffle or Tracecat.
Comparing FortiSOAR with self-hosted Shuffle: playbook building, the connector catalog against Shuffle's OpenAPI-based apps, case and incident handling, multi-tenancy for MSSPs, licensing tied to FortiGuard against Shuffle's AGPLv3 and MIT split, and who operates each.
FortiSOAR against Tracecat for SOCs that want case management and automation in one tool: workflows and AI agents, case handling, deployment on Docker, Kubernetes or air-gapped clusters, and which Tracecat capabilities, such as SSO and multi-tenant workspaces, sit in its paid edition.
Moving from FortiSOAR to Shuffle: inventorying playbooks, connectors and modules with the Configuration Export wizard, rebuilding playbooks as Shuffle workflows, replacing connectors with Shuffle apps, moving case data, and running both side by side until alert sources are switched over.
Moving FortiSOAR playbooks and incident records to Tracecat: mapping modules and record types to Tracecat cases and tables, rewriting playbook steps and Jinja expressions as Tracecat workflows and actions, and syncing custom actions from Git.
Cost of ownership by component: FortiSOAR subscriptions or licenses sized by users and nodes for HA and scale-out, its recommended 12 vCPU and 48 GB servers, against Shuffle's free open-source edition, your own infrastructure, migration work and the people who maintain workflows.
What FortiSOAR's Configuration Export wizard captures, such as playbooks, modules and connector settings, how to schedule exports as backups, what stays behind in records and FortiGuard-tied licensing, and how to turn the export into a migration inventory.
FortiSOAR fetches license entitlements from FortiGuard and needs FortiManager or a manual entitlement file in closed networks. This page compares that with Shuffle or Tracecat running fully offline, including image mirroring, app updates and how each handles losing contact with the vendor.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.