Playbook examples
Example: Using a FortiGuard connector
The FortiGuard connector is automatically configured when a valid Indicators of Compromise Service license has been applied to FortiAnalyzer. For more information about this license, see Viewing Compromised Hosts.
The FortiGuard connector can be used to perform an indicator lookup, which is used to determine the threat related information for indicator value types IP, URL, domain, and more.
For example, an admin investigating an Incident in FortiAnalyzer notices some traffic with unknown URLs. With the help of the FortiGuard real-time threat intelligence service, the admin can determine the enrichment information of the URL and then conclude if it is suspicious or not.
In the below example, a playbook is created to manually perform the indicator lookup and attach the data to an existing incident.
-
In FortiSoC > Automation > Playbook, create a new playbook from scratch.
-
For Triggers, select ON_DEMAND.
-
Create a task using the FortiGuard connector with the following configuration:
Name Enter a name for the connector. Description Optionally, enter a description for the connector. Connector
Select FortiGuard Connector.
Action
Select Lookup Indicator. The Indicator Value field displays.
Indicator Value
Select Playbook Starter and indicator_value.
-
Create a task using the FortiAnalyzer (local) connector with the following configuration:
Name Enter a name for the connector. Description Optionally, enter a description for the connector. Connector
Select Local Connector.
Action
Select Attach Data to Incident. The Incident ID and Attachment fields display.
Incident ID
Toggle to text mode and enter the Incident ID to attach the results to.
Attachment
Select Indicator_Lookup and indicators.
-
Save the playbook.
-
When you run the playbook, you must enter an indicator_value.
This indicator_value is a malicious IP, URL, or domain. The FortiGuard connector checks the FortiGuard threat database for information related to the indicator. If there is a match for the entered IP, URL, or domain in the threat database, the information from FortiGuard will be attached to the incident.
-
In FortiSoC > Incidents, open the Incident Analysis pane for the incident.
-
To view the attached results from the playbook, go to the Indicators tab.
-
For the threat details pulled from FortiGuard, click Detail.
