Trigger - FortiAnalyzer Event Handler

This feature adds a FortiAnalyzer event handler as an automation stitch trigger. You can trigger automation rules based on FortiAnalyzer event handlers, giving you the ability to define rules based on complex correlation across devices, log types, frequency, and other criteria.

When a FortiAnalyzer event handler is triggered, it sends a notification to the FortiGate automation framework, which generates a log and triggers the automation stitch.

In FortiAnalyzer Event Manager > FortiGate Event Handlers, configure the FortiAnalyzer event handler that will be triggered when FortiGate logs in.

In FortiGate Security Fabric > Settings, configure FortiAnalyzer and get authorized.

To configure Security Fabric Settings using the CLI:

config log fortianalyzer setting
    set status enable
    set server "10.6.30.250"
    set serial "FL-4HET318900407"
    set upload-option realtime
    set reliable enable
end

To configure Security Fabric Automation Stitch with trigger of FortiAnalyzer Event Handler in the GUI:

To configure Security Fabric Automation Stitch with trigger of FortiAnalyzer Event Handler in the CLI:

config system automation-action
    edit "auto-faz-1_email"
        set action-type email
        set email-to "jamesli@fortinet.com"
        set email-subject "CSF stitch alert"
        set email-body "User login FortiGate successfully."
    next
end

config system automation-trigger
    edit "auto-faz-1"
        set event-type faz-event
        set faz-event-name "system-log-handler2"
        set faz-event-severity "medium"
        set faz-event-tags "User login successfully"
    next
end

config system automation-stitch
    edit "auto-faz-1"
        set trigger "auto-faz-1"
        set action "auto-faz-1_email"
    next
end

To see the trigger event log in the GUI:

1. Log in to the FortiGate to trigger the FortiAnalyzer event.

   The FortiAnalyzer sends notification to the FortiGate automation framework and generates an event log in FortiGate and triggers the automation stitch.

   

Sample of the trigger event log in the CLI

date=2019-02-05 time=14:16:17 logid="0100046600" type="event" subtype="system" level="notice" vd="root" eventtime=1549404977 logdesc="Automation stitch triggered" stitch="auto-faz-1" trigger="auto-faz-1" from="log" msg="stitch:auto-faz-1 is triggered."

Sample of email sent when automation stitch is triggered