diff --git a/work/fortinet_soar.md b/work/fortinet_soar.md
index c7df015..57f8afd 100644
--- a/work/fortinet_soar.md
+++ b/work/fortinet_soar.md
@@ -82,19 +82,57 @@
   - Creating templates for common network and security configurations that adhere to organizational policies and best practices.
   - Ensuring templates are flexible enough to accommodate necessary variations or exceptions for different tenants.
   - Regularly reviewing and updating templates to align with evolving security standards and network requirements.
-// [
-// ## 5. Advanced Orchestration and Dynamic Configuration
-// - **Enhanced SOAR Playbooks**: Evolve SOAR playbooks for complex security scenarios, including multi-layered incident response and proactive threat management.
-// - **Dynamic Template Integration**: Integrate and adapt SOAR configuration templates dynamically, aligning them with real-time data for responsive network management.
-// 
-// ## 6. Scalable and Customizable Configuration Management
-// - **Modular Configuration Templates**: Design SOAR configuration templates to be modular, allowing for scalability and adaptability to different network sizes and tenant requirements.
-// - **Customization Options**: Implement customization capabilities within the templates, providing flexibility for tenant-specific adjustments while adhering to overarching security policies.
-// 
-// ## 7. Continuous Monitoring and Reporting
-// - **Comprehensive Monitoring System**: Develop a robust monitoring framework within SOAR for continuous surveillance of network health, security status, and operational performance.
-// - **Feedback and Reporting Mechanisms**: Integrate mechanisms for regular performance reporting, incident logging, and actionable insights within SOAR, facilitating ongoing evaluation and optimization.
-// ]
+
+## 5. Advanced Orchestration and Dynamic Configuration
+
+### Enhanced SOAR Playbooks
+- **Objective**: Develop advanced SOAR playbooks to handle complex and evolving security scenarios.
+- **Key Steps**:
+  - Analyzing historical security incidents and current threat landscapes to identify patterns requiring advanced response strategies.
+  - Designing multi-tiered incident response playbooks that initiate different actions based on the severity and nature of the threat.
+  - Incorporating AI and machine learning techniques, where applicable, to enhance threat detection and response capabilities.
+  - Continuously testing and updating playbooks to ensure effectiveness against emerging threats.
+
+### Dynamic Template Integration
+- **Objective**: Ensure SOAR configuration templates are dynamically adapted to changing network conditions and threats.
+- **Key Steps**:
+  - Developing a mechanism within SOAR for real-time adjustment of configuration templates based on network data inputs.
+  - Setting criteria and thresholds for when template adjustments should be triggered.
+  - Implementing a feedback loop from network monitoring tools to continuously inform template adjustments.
+  - Ensuring that dynamic changes adhere to security and compliance standards.
+
+## 6. Scalable and Customizable Configuration Management
+
+### Modular Configuration Templates
+- **Objective**: Create modular and scalable configuration templates in SOAR to accommodate various network environments and tenant needs.
+- **Key Steps**:
+  - Structuring templates to be component-based, allowing elements to be added or removed easily to scale up or down.
+  - Designing templates with placeholders for customizable elements to cater to specific tenant requirements.
+  - Regularly reviewing and updating templates to ensure they support the latest network technologies and standards.
+
+### Customization Options
+- **Objective**: Provide customization options within SOAR templates to meet specific tenant demands while maintaining core security policies.
+- **Key Steps**:
+  - Developing a user-friendly interface in SOAR for administrators to customize templates.
+  - Establishing guidelines and boundaries for customization to ensure security standards are not compromised.
+  - Offering a range of pre-approved customization options based on common tenant needs.
+
+## 7. Continuous Monitoring and Reporting
+
+### Comprehensive Monitoring System
+- **Objective**: Implement a comprehensive and proactive monitoring system within SOAR.
+- **Key Steps**:
+  - Integrating SOAR with network monitoring tools to gather real-time data on network performance, security status, and anomalies.
+  - Utilizing dashboards and visual analytics in SOAR for continuous oversight of network health.
+  - Setting up alerting mechanisms in SOAR for immediate notification of potential issues or security breaches.
+
+### Feedback and Reporting Mechanisms
+- **Objective**: Establish effective feedback and reporting mechanisms within SOAR for ongoing system optimization.
+- **Key Steps**:
+  - Creating automated reports within SOAR that summarize network performance, incident responses, and compliance status.
+  - Developing a process for collecting user feedback and operational insights from system administrators and end-users.
+  - Implementing a review system in SOAR for regularly assessing report findings and feedback, leading to system adjustments and improvements.
+
 ## 8. Compliance Enforcement and Governance
 - **Automated Compliance Checks**: Embed automated compliance verification within SOAR playbooks, ensuring consistent adherence to industry regulations and internal policies.
 - **Governance Policies Implementation**: Formulate and enforce a comprehensive governance framework within the SOAR platform to guide configuration management and maintain compliance with established standards and best practices.
@@ -110,7 +148,6 @@
 ## Conclusion
 This HLD outlines a comprehensive and structured approach for the integration of FMG, FGW, and SOAR in a multi-tenant environment. The design emphasizes scalability, automation, and standardization, balanced with flexibility to cater to specific tenant needs. It provides a robust framework for efficient network management, proactive security posture, and adherence to compliance and governance standards, with a strong focus on continuous improvement and adaptability to evolving technological and security challenges.
 
-
 ---
 
 # Detailed Design Document (DDD) for Network Management Integration