Connector actions
This topic provides details for the following connectors:
For more information about the uses of ITSM connectors, see Configuring ITSM connectors.
Local Connector
The local connector is the default connector for FortiAnalyzer and is available automatically. The local connector displays a set of predefined FortiAnalyzer actions to be used within playbooks.
Local connectors include the following actions:
|
Name |
Description |
|---|---|
|
Update Asset and Identity |
Update FortiAnalyzer's Asset and Identity. |
|
Get Events |
Get events. |
|
Get Endpoint Vulnerabilities |
Get endpoint vulnerabilities. |
|
Create Incident |
Create a new incident. |
|
Update Incident |
Update an existing incident. |
|
Attach Data to Incident |
Attach the specified data to an existing incident. |
|
Run Report |
Run the specified FortiAnalyzer report. |
|
Get EPEU from incidents |
Get the EPEU from an incident. |
|
Enrich Start |
Start indicator enrichment workflow. |
|
Enrich Aggregate |
Aggregate indicator enrichment results. |
|
Enrich Save |
Save indicator enrichment. |
|
Get Disk Usage |
Get FortiAnalyzer's disk usage. |
|
Get Virtual Memory |
Get FortiAnalyzer's virtual memory. |
|
Get CPU Usage |
Get FortiAnalyzer's CPU usage. |
FortiOS Connector
The FortiOS connector is added after the first FortiGate has been authorized on an ADOM. Additional devices authorized to the ADOM are displayed as separate entries within the same connector. FortiOS connectors are available in FortiGate and Fabric ADOMs.
Enabling FortiOS actions
The actions available with FortiOS connectors are determined by automation rules configured on each FortiGate. Automation rules using the Incoming Webhook trigger must be created in FortiOS before they are shown as actions in FortiAnalyzer. FortiOS automation rules are configured on FortiOS in Security Fabric > Automation. For information on creating FortiOS automation rules, see the FortiOS administration guide.
Rules for FortiOS actions:
-
Automation rules must use the Incoming Webhook trigger.
-
Automation rules are configured on FortiGate devices individually.
-
When multiple FortiOS connectors are configured, FortiAnalyzer decides which device to call based on the devid (serial number) identified in the task. FortiGate serial numbers can be manually entered or supplied by a preceding task.
-
Automation rules must have unique names to be displayed in the task's Action dropdown menu. Rules sharing the same name will appear only once, as they are considered to be the same automation rule configured on multiple FortiGate devices.
-
FortiOS automation rules are only displayed in Incidents & Events > Automation > Active Connectors when they are enabled in FortiOS.
FortiGuard Connector
The FortiGuard connector is automatically configured when a valid license has been applied to FortiAnalyzer.
FortiGuard connectors include the following actions:
|
Name |
Description |
|---|---|
|
Lookup Indicator |
Lookup indicators in FortiGuard to get threat intelligence. |
|
FGD Enrich |
Get the reputation report for indicator enrichment. |
|
The FortiGuard connector cannot be used in an air-gap environment. |
EMS Connector
FortiClient EMS connectors are configured as Security Fabric connectors. See Configuring security fabric connectors. Individual FortiClient EMS connector actions can be toggled on and off while editing the connector.
FortiClient EMS connectors include the following actions:
|
Name |
Description |
|---|---|
|
Get Endpoints |
Retrieve list of endpoints and all of the related information to enrich FortiAnalyzer asset and identity views. |
|
Quarantine |
Quarantines an endpoint. |
|
Unquarantine |
Unquarantines an endpoint. |
|
Vulnerability Scan |
Run a vulnerability scan on endpoints. |
|
AV Quick Scan |
Run a quick antivirus scan on endpoints. |
|
AV Full Scan |
Run a full antivirus scan on endpoints. |
|
Get Software Inventory |
Retrieve list of software and apps installed on an endpoint to enrich FortiAnalyzer asset view. |
|
Get Process List |
Retrieve list of running process on endpoints OS. |
|
Get Vulnerabilities |
Retrieve list of endpoint vulnerabilities on endpoints OS. |
|
Tag Endpoints |
Tag endpoints. |
|
Untag Endpoints |
Untag endpoints. |
FortiMail Connector
FortiMail connectors are configured as Security Fabric connectors. See Configuring security fabric connectors.
FortiMail connectors include the following actions:
|
Name |
Description |
|---|---|
|
Get Email Statistics |
Query a given email address. |
|
Get Sender Reputation |
Query a given sender's reputation information. |
|
Add Sender to Blocklist |
Update system and domain level blocklist. |
|
Get Session Profile |
Get the session profile from FortiMail. |
|
Delete Session Profile |
Delete the session profile from FortiMail. |
|
Get Sender Block List |
Get the list of blocked senders' email addresses from a session profile. |
|
Get Sender Safe List |
Get the list of safelisted senders' email addresses from a session profile. |
|
Get Recipient Block List |
Get the list of blocked recipients' email adddresses from a session profile. |
|
Get Recipient Safe List |
Get the list of safelisted recipients' email adddresses from a session profile. |
|
Block Sender Email with Session Profile |
Block sender's email address with a session profile. |
|
Unblock Sender Email with Session Profile |
Unblock sender's email address with a session profile. |
|
Block Recipient Email with Session Profile |
Block recipient's email address within a session profile. |
|
Unblock Recipient Email with Session Profile |
Unblock recipient's email address within a session profile. |
FortiCASB Connector
FortiCASB connectors are configured as Security Fabric connectors. See Configuring security fabric connectors.
Creating a FortiCASB connector will automatically create the Get Cloud Service Data (FortiCasb Connector) playbook, which must be enabled to use the predefined Default-Shadow-IT-Events event handler. For more information, see Predefined basic event handlers.
FortiCASB connectors include the following actions:
|
Name |
Description |
|---|---|
|
Get Cloud Data from FCASB |
Retrieve cloud application, user, and file information. |
FortiAuthenticator Connector
|
Name |
Description |
|---|---|
|
Get Schema |
Retrieves a report for all the endpoint actions within FortiAuthenticator. |
|
Get User List |
Retrieves a list of users from FortiAuthenticator. |
|
Get User |
Retrieves details of a specific user from FortiAuthenticator based on the user ID, username, or email you have specified. |
|
Update User Status |
Updates the user status of a specific user in FortiAuthenticator based on the user ID and status you have specified. |
|
Get User Lockout Policy |
Retrieves User Lockout Policy details from FortiAuthenticator. |
FortiWeb Connector
|
Name |
Description |
|---|---|
|
Get Anomaly Policy |
Retrieves the domain information of a specific Anomaly Detection policy from FortiWeb based on the policy name you have specified. |
|
Get Blocked IPs |
Retrieves all the blocked IPs from the FortiWeb server. |
|
Unblock IPs |
Release all IPs from the blocked IP list under a specific policy in FortiWeb or release one IP from the blocked IP list under a specific policy in FortiWeb based on the policy name and other input parameters you have specified. |
|
Get Blocked Users |
Retrieves all blocked users or specific blocked users from FortiWeb based on the input parameters you have specified. |
|
Unblock Users |
Releases users from the blocked user list in a server policy in FortiWeb based on the input parameters you have specified. |
|
Get Active Users |
Retrieves a list of active users by user tracking or site publish type from FortiWeb based on the input parameters you have specified. |
|
Delete Active Users |
Deletes active users from a specific policy from FortiWeb based on the policy ID and other input parameters you have specified. |
|
Get Client Info |
Retrieves client information in Client Management in FortiWeb based on the input parameters you have specified. |
|
Delete Client Information |
Deletes information for a specific client from Client Management in FortiWeb based on the client ID you have specified. |
|
Restore Client Threat Score |
Restores the threat score of a specific client to 0 in FortiWeb based on the client ID you have specified. |
|
Get All Virtual Servers |
Retrieves all virtual servers, virtual IP, and interfaces in each virtual server sub-table in the JSON format from FortiWeb. |
|
Get All Physical Servers |
Retrieves the IP addresses in the server pool of all physical servers in the JSON format from FortiWeb. |
|
Get Server Policy Status |
Retrieves the details including the status of a server policy from FortiWeb. |
|
Get Server Policy Traffic |
Retrieves traffic information for traffic on all the system server policies from FortiWeb, or traffic information for a specific system server policy based on the policy name you have specified from FortiWeb. |
FortiSandbox Connector
|
Name |
Description |
|---|---|
|
Get System Status |
Retrieves the status of the system from FortiSandbox. |
|
Get Scan Status |
Retrieves the scan stats for the last 7 days from FortiSandbox. |
|
Get Submission Job List |
Retrieves all job IDs associated with the submission ID you have specified from FortiSandbox. |
|
Get Job Verdict |
Retrieves job verdict detail for job ID you have specified from FortiSandbox. |
|
Get File Rating |
Retrieves file rating for the file type and filehash you have specified from FortiSandbox. |
|
Get URL Rating |
Get rating details for the URL you have specified from FortiSandbox. |
|
Get Job Behavior |
Retrieves job behavior details associated with the file type and filehash you have specified from FortiSandbox. |
|
Toggle FPN State |
Marks specified sample based on the Job ID you have specified as false negative or false positive in FortiSandbox. |
|
Get AV Rescan Result |
Retrieves AV-Rescan results for the time duration you have specified from FortiSandbox. |
|
Get File Verdict |
Retrieves the file verdict details for the file type and filehash you have specified from FortiSandbox. |
|
Get All Installed VM |
Retrieves the names and the clone numbers of all installed VMs on FortiSandbox. |
|
List Filehash or URL From Malware Package or URL Package |
Retrieves a list of file hashes or URLs based on the type you have specified from the Malware Package or URL Package in FortiSandbox. |
VirusTotal Connector
The VirusTotal connector is used as part of the indicator enrichment feature through the Indicator Enrichment playbook. For more information, see Indicator enrichment.
The VirusTotal connector includes the following actions:
|
Name |
Description |
|---|---|
|
Query IP |
Retrieves a report from VirusTotal for the IP address submitted to determine if it is suspicious based on the IP address you have specified. |
|
Query Domain |
Retrieves a report from VirusTotal for the domain submitted to determine if it is suspicious based on the domain name you have specified. |
|
Query URL |
Retrieves a report from VirusTotal for the URL submitted to determine if it is suspicious based on the URL you have specified. |
|
VIRUSTOTAL Enrich |
Enrich the indicator. |
vSphere Connector
|
Name |
Description |
|---|---|
|
Ingest vSphere Server Event Logs |
Retrieves event logs from vSphere and ingests into FortiAnalyzer. |
When you save a vSphere connector, a new playbook will automatically be added in the backend named, Ingest vSphere Server Event Logs. This playbook is run as per the schedule defined in the Data Ingestion tab. To configure Data Ingestion, see Configuring security fabric connectors. This playbook is not visible in the GUI, however its logs are available for troubleshooting under Playbook Monitor .
After the first time the playbook is run, it will pull all the logs from the vSphere server to FortiAnalyzer. It will also create a new External-SIEM-Events device in Device Manager; the device is automatically authorized and only one of such device is created per ADOM for all of the third-party connectors. Then the logs pulled from the server can be seen in Log View > Logs > All alongside other Fabric/SIEM logs; the logs are parsed by the predefined VMware Log Parser and assigned to the new external SIEM device. In Log Browse, the logs files will be available from the new device. The next time the playbook runs, only the new logs after the previous pull will be fetched and added to Log View.
The FortiAnalyzer CLI command "diagnose test application fazwatchd 10" can be used to check the ingestion stats or to manually trigger a playbook:
diagnose test application fazwatchd 10
Airflow Diag Usage:
info show generic airflow information
scheduler show airflow scheduler status
global-monitor show global monitor status
health-check-stat show health check status
ingestion-stat show data ingestion status
trigger-playbook execute a playbook
reset reset airflow database
logging-level set airflow logging level
reset-log-dir reset airflow log directory