FortiRecon – Ultra Detailed Installation
Guide with Explanations
1. Step 1: FortiRecon is a SaaS-delivered service. Go to
https://www.fortinet.com/products/digital-risk-protection/fortirecon and click
'Request Demo' or 'Login'.
→ FortiRecon does not require on-prem installation; it's fully cloud-based.
2. Step 2: Fortinet team will provision your tenant and share login credentials via email.
→ A provisioned account is necessary to access your tenant environment.
3. Step 3: Log in to the FortiRecon portal at https://fortirecon.fortinet.com.
→ Access the centralized dashboard and tools from your secure tenant URL.
4. Step 4: Upon first login, configure your organization’s name, sectors, and geolocation.
→ These initial settings help FortiRecon tailor monitoring to your industry and risk
profile.
5. Step 5: Go to 'Digital Footprint' and add your domain, IP ranges, subdomains, and assets.
→ Digital Footprint setup identifies assets and exposure externally visible to attackers.
6. Step 6: Under 'Threat Intelligence', select your threat priorities (e.g., brand abuse,
impersonation, credential leaks).
→ You prioritize what FortiRecon should alert on from its global intel feed.
7. Step 7: Configure monitoring alerts and notification channels (email, webhook, SIEM
integration).
→ Custom alerting helps SOC teams respond faster to actual threats.
8. Step 8: Enable shadow IT discovery and SaaS exposure mapping.
→ Shadow IT discovery tracks unauthorized cloud or SaaS use by employees.
9. Step 9: Define incident severity levels under Settings > Incident Response.
→ Categorizing incidents improves escalation paths and response timelines.
10. Step 10: Set up user roles under Administration > User Management.
→ RBAC is enforced by assigning roles for visibility, triage, and control.
11. Step 11: Schedule PDF or CSV reports for brand risk and external attack surface.
→ Scheduled reports ensure management and compliance visibility.
12. Step 12: Monitor for phishing kits and fake domains under Brand Monitoring.
→ FortiRecon watches for phishing attempts and domain hijacking.
13. Step 13: Enable alert triaging and response recommendations in the dashboard.
→ Automated recommendations improve response efficiency.
14. Step 14: Integrate with FortiSIEM or 3rd party SIEM via API token from Integration
Settings.
→ API integration allows correlation with existing security platforms.
15. Step 15: Use takedown request tools to initiate response for malicious domains or social
profiles.
→ Takedown tools automate legal and technical mitigation of threats.
16. Step 16: Enable credential leak monitoring under Dark Web Intelligence.
→ Credential leaks from breaches are monitored and flagged instantly.
17. Step 17: Enable VIP monitoring for executive exposure on social platforms.
→ Protection for executives against impersonation on social media.
18. Step 18: Schedule weekly reviews with security teams to validate FortiRecon findings.
→ Review meetings ensure that SOC stays ahead of current threats.
19. Step 19: Export vulnerability data for attack surface analysis under Reports > Export.
→ Export capabilities allow further forensic or risk analysis.
20. Step 20: Continuously refine threat coverage based on real-time alerts and FortiRecon
analytics.
→ FortiRecon adapts as threat landscape changes using analytics.
