Fortinet black logo

Cookbook

FortiAnalyzer event handler trigger

Copy Link
Copy Doc ID 9bd2f947-ece6-11ec-bb32-fa163e15d75b:176287
Download PDF

FortiAnalyzer event handler trigger

You can trigger automation stitches based on FortiAnalyzer event handlers. This allows you to define rules based on complex correlations across devices, log types, frequencies, and other criteria.

To set up a FortiAnalyzer event handler trigger:

  1. Configure a FortiGate event handler on the FortiAnalyzer
  2. Configure FortiAnalyzer logging on the FortiGate
  3. Configure an automation stitch that is triggered by a FortiAnalyzer event handler

Configure a FortiGate event handler on the FortiAnalyzer

On the FortiAnalyzer, configure an event handler for the automation stitch. In this example, the event handler is triggered when an administrator logs in to the FortiGate.

To configure an event handler on the FortiAnalyzer:
  1. Go to Incidents & Events > Handlers > FortiGate Event Handlers.
  2. Configure an event handler for the automation stitch.

  3. Click OK.

Configure FortiAnalyzer logging on the FortiGate

See Configuring FortiAnalyzer for more information.

To configure FortiAnalyzer logging in the GUI:
  1. Go to Security Fabric > Settings.
  2. Enable and configure FortiAnalyzer Logging.

  3. Click Apply.
To configure FortiAnalyzer logging in the CLI:
config log fortianalyzer setting
    set status enable
    set server "10.6.30.250"
    set serial "FL-4HET318900407"
    set upload-option realtime
    set reliable enable
end

Configure an automation stitch that is triggered by a FortiAnalyzer event handler

When a FortiAnalyzer event handler is triggered, it sends a notification to the FortiGate automation framework, which generates a log and triggers the automation stitch.

To configure an automation stitch that is triggered by a FortiAnalyzer event handler in the GUI:
  1. Go to Security Fabric > Automation.
  2. Click Create New.
  3. In the Trigger section, select FortiAnalyzer Event Handler.
  4. Set Event handler name to the event that was created on the FortiAnalyzer.
  5. Set the Event severity, and select or create an Event tag.

  6. In the Action section, select Email and configure the email recipient and message.
  7. Click OK.
To configure an automation stitch that is triggered by a FortiAnalyzer event handler in the CLI:
  1. Create an automation action:
    config system automation-action
        edit "auto-faz-1_email"
            set action-type email
            set email-to "jnjssll@fortinet.com"
            set email-subject "CSF stitch alert"
            set email-body "User login FortiGate successfully."
        next
    end
  2. Create an automation trigger:
    config system automation-trigger
        edit "auto-faz-1"
            set event-type faz-event
            set faz-event-name "system-log-handler2"
            set faz-event-severity "medium"
            set faz-event-tags "User login successfully"
        next
    end
  3. Create the automation stitch:
    config system automation-stitch
        edit "auto-faz-1"
            set trigger "auto-faz-1"
            set action "auto-faz-1_email"
        next
    end

View the trigger event log

To see the trigger event log in the GUI:
  1. Log in to the FortiGate.

    The FortiAnalyzer sends notification to the FortiGate automation framework, generates an event log on the FortiGate, and triggers the automation stitch.

  2. Go to Log & Report > Events and select System Events.

To see event logs in the CLI:
execute log display
    ...
    date=2019-02-05 time=14:16:17 logid="0100046600" type="event" subtype="system" level="notice" vd="root" eventtime=1549404977 logdesc="Automation stitch triggered" stitch="auto-faz-1" trigger="auto-faz-1" from="log" msg="stitch:auto-faz-1 is triggered."
    ...

Sample email

The email sent by the action will look similar to the following:

FortiAnalyzer event handler trigger

You can trigger automation stitches based on FortiAnalyzer event handlers. This allows you to define rules based on complex correlations across devices, log types, frequencies, and other criteria.

To set up a FortiAnalyzer event handler trigger:

  1. Configure a FortiGate event handler on the FortiAnalyzer
  2. Configure FortiAnalyzer logging on the FortiGate
  3. Configure an automation stitch that is triggered by a FortiAnalyzer event handler

Configure a FortiGate event handler on the FortiAnalyzer

On the FortiAnalyzer, configure an event handler for the automation stitch. In this example, the event handler is triggered when an administrator logs in to the FortiGate.

To configure an event handler on the FortiAnalyzer:
  1. Go to Incidents & Events > Handlers > FortiGate Event Handlers.
  2. Configure an event handler for the automation stitch.

  3. Click OK.

Configure FortiAnalyzer logging on the FortiGate

See Configuring FortiAnalyzer for more information.

To configure FortiAnalyzer logging in the GUI:
  1. Go to Security Fabric > Settings.
  2. Enable and configure FortiAnalyzer Logging.

  3. Click Apply.
To configure FortiAnalyzer logging in the CLI:
config log fortianalyzer setting
    set status enable
    set server "10.6.30.250"
    set serial "FL-4HET318900407"
    set upload-option realtime
    set reliable enable
end

Configure an automation stitch that is triggered by a FortiAnalyzer event handler

When a FortiAnalyzer event handler is triggered, it sends a notification to the FortiGate automation framework, which generates a log and triggers the automation stitch.

To configure an automation stitch that is triggered by a FortiAnalyzer event handler in the GUI:
  1. Go to Security Fabric > Automation.
  2. Click Create New.
  3. In the Trigger section, select FortiAnalyzer Event Handler.
  4. Set Event handler name to the event that was created on the FortiAnalyzer.
  5. Set the Event severity, and select or create an Event tag.

  6. In the Action section, select Email and configure the email recipient and message.
  7. Click OK.
To configure an automation stitch that is triggered by a FortiAnalyzer event handler in the CLI:
  1. Create an automation action:
    config system automation-action
        edit "auto-faz-1_email"
            set action-type email
            set email-to "jnjssll@fortinet.com"
            set email-subject "CSF stitch alert"
            set email-body "User login FortiGate successfully."
        next
    end
  2. Create an automation trigger:
    config system automation-trigger
        edit "auto-faz-1"
            set event-type faz-event
            set faz-event-name "system-log-handler2"
            set faz-event-severity "medium"
            set faz-event-tags "User login successfully"
        next
    end
  3. Create the automation stitch:
    config system automation-stitch
        edit "auto-faz-1"
            set trigger "auto-faz-1"
            set action "auto-faz-1_email"
        next
    end

View the trigger event log

To see the trigger event log in the GUI:
  1. Log in to the FortiGate.

    The FortiAnalyzer sends notification to the FortiGate automation framework, generates an event log on the FortiGate, and triggers the automation stitch.

  2. Go to Log & Report > Events and select System Events.

To see event logs in the CLI:
execute log display
    ...
    date=2019-02-05 time=14:16:17 logid="0100046600" type="event" subtype="system" level="notice" vd="root" eventtime=1549404977 logdesc="Automation stitch triggered" stitch="auto-faz-1" trigger="auto-faz-1" from="log" msg="stitch:auto-faz-1 is triggered."
    ...

Sample email

The email sent by the action will look similar to the following: