Execute multiple automation actions based on security events

Automation stitches can be created to send out notifications when a security event occurs, such as from a WAP or DDoS attack.

In this example, three automation stitches are created that will send an Email, Syslog, and an SNMP Trap to notify the SOC team in the event of a DDoS attack.

To create the automation stitch and define the event trigger:

1. Go to Security Fabric > Automation.
2. Select Create New.
3. Enter a name for the stitch.
4. Select Enable to enable this automation.
5. Select the trigger Security Events.
6. Select the security events that will trigger the actions.
7. Select the actions to automate.

   

8. Configure each automation action.
9. Select Save.

To configure the Email action:

Enter the following settings.

Name	The action name.
To	The email address of the recipient of this notification.
Email Subject	The email subject line.
Email Body	The email body.

To configure the Syslog action:

Enter the following settings.

Name	The action name.
Delay	The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).
Address	The IP address that will receive this message.
Port	The port that will receive this message. Range is 1 - 65535.

To configure the SNMP Trap action:

Enter the following settings.

Name	The action name.
Delay	The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).
Hosts	The IP address that will receive this message.
Version	The SNMP version to use: v1, v2c, or v3.
Local Port	The source port number (0 - 65535, default = 162).
Remote Port	The destination port number (0 - 65535, default = 162).
Security Level	The SNMP security level to use: Auth But no Privacy, Auth And Privacy, or No Privacy. Available only if v3 is selected for Version.
Auth Algorithm	The authentication algorithm to use. Available only if Auth But no Privacy or Auth And Privacy is selected for Security Level.
Auth Password	The password to the authentication algorithm. Available only if Auth But no Privacy or Auth And Privacy is selected for Security Level.
Private Algorithm	The private algorithm to use. Available only if Auth And Privacy is selected for Security Level.
Private Password	The password to the private algorithm. Available only if Auth And Privacy is selected for Security Level.