Vers un SOC de nouvelle génération : unifier SIEM, SOAR et EDR

David Krzesiak, a business development engineer for SecOps at Fortinet with prior hands-on experience in European SOCs, lays out Fortinet's vision for a next-generation security operations center. He contrasts traditional SOCs, alert-centric, siloed from network operations and heavily manual, with the pressures pushing them past their limits: an exploded attack surface, more targeted attacks, fragmented multi-vendor visibility, and analyst burnout from alert volume. He introduces a three-level maturity model, log collection, cross-vendor correlation, then automation, mapped to Fortinet's SOC-CMM-based ECOPS reference architecture, and argues organizations should assess real maturity before buying tools. He walks through three products that build on each other: FortiEDR for endpoint detection that extends into XDR-style actions on non-Fortinet tools; FortiSIEM, a vendor-agnostic correlation engine merging NOC performance data with SOC security events; and FortiSOAR, which uses bidirectional connectors and playbooks to automate response, plus a conversational 'FortiAI Assist' virtual analyst. A worked example shows detection collapsing from hours of manual triage to seconds of automated isolation. He closes with a brief Q&A on FortiEDR's origins and replacing an existing SIEM.