Attach FortiMail connector actions to incidents
This feature will help users to see the result of FortiMail playbook actions in the incident analysis page. Information can be found within the Indicators tab of the incident analysis page once added.
To use the action in a FortiSoC playbook:
- Go to Fabric View. Click Create New and choose FortiMail under the Security Fabric category. Configure the FortiMail connector settings, and click OK.
- Create a playbook to get email statistics and attach the data to an incident.
Go to FortiSoC > Automation > Playbook, and create a new playbook from scratch. In this example, the playbook is called GetMailStats.- Select the On_Demand trigger as the starter.
- Create a task using the FortiMail connector with the Get Email Statistics action.
- Create a second task using the local connector with the Attach Data to Incident action.
- Click OK to save the playbook.
- Create a second playbook to get the sender reputation and attach the data to an incident. In this example, the playbook is called GetSenderReputation.
- Select the On_Demand trigger as the starter.
- Create a task using the FortiMail connecter with the Get Sender Reputation action.
- Create a second task using the local connector with the Attach Data to Incident action.
- Click OK to save the playbook.
- Run the GetMailStats playbook to retrieve statistics for the provided email address. This example uses
u2@test1.com.
- Run the GetSenderReputation playbook.
- Go to FortiSoC > Automation > Playbook Monitor to confirm that both playbooks completed successfully.
- Go to FortiSoC > Incidents. Right-click on the selected incident and select Analysis.
In the Analysis page, select Indicators. The playbook action results are displayed.
Click on the details for the u2@test1 email address. The detailed statistics are displayed.
Click on the details for the 172.16.81.1 address. The detailed reputation is displayed.