· Blog

Blog

Notes on SOC operations, the Fortinet ecosystem and security automation.

July 25, 2026n8nFortiEDRLLMSOC

An autonomous MDR agent with n8n: triaging EDR alerts with an LLM

The anatomy of our production n8n workflow that polls FortiEDR alerts every 5 minutes, classifies them as FP/TP/SUSPICIOUS with an LLM, and gates critical actions behind human approval over WhatsApp.

July 25, 2026MCPFortiEDRPythonOpen Source

FortiEDR MCP Server: opening the EDR console to natural language

An open-source MCP server that connects 146 FortiEDR API endpoints to LLM assistants like Claude, designed for MSSP operations — why I built it and how it's designed.