Creating or editing ITSM connectors
You can create ITSM connectors for ServiceNow, Slack, MS Teams, and Webhook.
To create an ITSM connector:
- Go to Fabric View > Fabric Connectors, and click Create New.
- Under ITSM, click ServiceNow Connector, Slack Connector, MS Teams Connector, or Generic Connector and click Next.
- Configure the following options, and click OK:
Property
Description
Name
Enter a name for the fabric connector.
Description
(Optional) Enter a description for the fabric connector.
Protocol
Select HTTPS.
For Slack connectors and Generic connectors, you can also select HTTP.
Port
Specify the port FortiAnalyzer uses to communicate with the external platform.
Method
For ServiceNow and MS Teams connectors, select POST.
For Slack connectors, select POST or PUT.
For Generic connectors, select one of the following:
POST
PUT
GET
PATCH
DELETE
Title
Type a title for the fabric connector.
URL
Type the URL of the external platform. This option is not available for the MS Teams connector.
Using ServiceNow as an example, copy and paste the URL from ServiceNow API URL in the Connection to ServiceNow API section in ServiceNow > FortiAnalyzer System Properties.
Custom HTTP Header
Enable to use custom HTTP headers. This option is only available for Generic connectors.
These headers store information in the form of key-value pairs. They can be used for communcation control, content description, authentication, session management, caching, and more.
If enabled, add any number of HTTP Headers by clicking the plus sign (+). Enter the key-value pairs.
When Custom HTTP Header is enabled, HTTP Authentication is no longer available for the connector. This is because you can use the custom HTTP headers for HTTP authentication instead.
Teams Webhook URL
Type the incoming webhook URL created in MS Teams. This option is only available for the MS Teams connectors.
HTTP Body
Type the HTTP body of the message that should be sent by the connector. This option is only available for Generic and MS Teams connectors.
For example,
{ \"text\": \"<message to send>\" }. You also use${}for macros in the message. For a list of supported macros, see Supported macros for the MS Teams Connector.HTTP Authentication
Enable to use HTTP authentication. This option is not available for the MS Teams connectors.
If enabled, select Basic or OAuth2 authentication type. Enter the User Name and Password, if applicable.
Using a ServiceNow connector with Basic authenictation as an example, enter the username and password from the Connection to ServiceNow API section in ServiceNow > FortiAnalyzer System Properties.
Using a Generic webhook connector with OAuth2 authentication as an example, enter the URL of the token service as well as the client ID and client secret for authentication.
Status
Enable or disable the fabric connector.
To use a generic connector:
Generic webhook connectors can be used to send notifications about incidents and events. After it is created, the connector can be added in the incident settings or in notification profiles for event handlers. They can also be used as part of a playbook; for example, see Playbook examples.
To use a ServiceNow connector:
ServiceNow connectors can be used to post incident change notices. After it is created, the ServiceNow connector can be added in the incident settings or as part of a playbook.
To use a Slack connector:
Slack connectors can be used to send messages in Slack about incidents and events. After it is created, the Slack connector can be added in the incident settings or notification profiles for event handlers.
To use an MS Teams connector:
MS Teams connectors can be used to send messages in MS Teams about incidents and events. After it is created, the MS Teams connector can be added in the incident settings, notification profiles for event handlers, or as part of a playbook.
To edit an ITSM connector:
- Go to Fabric View > Fabric Connectors.
- Right-click an ITSM connector, and select Edit.
The Edit Connectors dialog box is displayed.
- Edit the settings, and click OK.
Supported macros for the MS Teams Connector
|
Category |
Variable |
Macro |
Description |
|---|---|---|---|
|
Global |
type |
${type} |
Notification type |
|
Global |
adom |
${adom} |
Adom name |
|
Global |
from |
${from} |
FAZ SN |
|
Global |
timestamp |
${timestamp} |
Notification timestamp |
|
Event |
event |
${event} |
All event fields |
|
Event |
eventid |
${event.eventid} |
Event id |
|
Event |
alertid |
${event.alertid} |
Alert id (same with eventid, but name consistent with previous notification format) |
|
Event |
logtype |
${event.logtype} |
Log type |
|
Event |
devtype |
${event.devtype} |
Device type |
|
Event |
eventtime |
${event.eventtime} |
Event time |
|
Event |
alerttime |
${event.alerttime} |
Alert time (same with eventtime, but name consistent with previous notification format) |
|
Event |
firstlogtime |
${event.firstlogtime} |
First log time |
|
Event |
lastlogtime |
${event.lastlogtime} |
Last log time |
|
Event |
devid |
${event.devid} |
Device id |
|
Event |
devname |
${event.devname} |
Device name |
|
Event |
eventtype |
${event.eventtype} |
Event type |
|
Event |
groupby1 |
${event.groupby1} |
groupby1 |
|
Event |
groupby2 |
${event.groupby2} |
grouby2 |
|
Event |
groupby3 |
${event.groupby3} |
grouby3 |
|
Event |
indicator |
${event.indicator} |
indicator |
|
Event |
severity |
${event.severity} |
severity |
|
Event |
subject |
${even.subject} |
subject |
|
Event |
tag |
${event.tag} |
tag |
|
Event |
triggername |
${event.triggername} |
Trigger name |
|
Event |
vdom |
${event.vdom} |
vdom |
|
Event |
epid |
${event.epid} |
epid |
|
Event |
euid |
${event.euid} |
euid |
|
Event |
epip |
${event.epip} |
epip |
|
Event |
epname |
${event.epname} |
epname |
|
Event |
euname |
${event.euname} |
euname |
|
Event |
extrainfo |
${event.extrainfo} |
Additional info |
|
Event |
log-length |
${event.log-length} |
Log length |
|
Event |
log-detail |
${event.log-detail} |
Log detail |
|
Incident |
incident |
${incident} |
All incident fields |
|
Incident |
incid |
${incident.incid} |
Incident ID |
|
Incident |
type |
${incident.type} |
Notification type |
|
Incident |
revision |
${incident.revision} |
revision |
|
Incident |
attach_revision |
${incident.attach_revision} |
attach revision |