Azure Function action

Azure functions can be called when an automation stitch is triggered.

To configure an Azure function automation stitch in the GUI:

1. Go to Security Fabric > Automation.
2. Click Create New.
3. Enter a name for the stitch, and select the FortiGate devices that it will be applied to.
4. Select a trigger, such as Security Rating Summary.
5. Select Azure Function and configure its settings.

   

   Name	The action name.
   Delay	The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).
   API gateway	The API gateway URL, in the format: {application}.{domain}/api/{function} The CLI must be used to manually enter the individual parameters.
   Authorization	The authorization level: Anonymous, Function, or Admin.
   API key	The API key configured in your API gateway. This options is only available when Authorization is not Anonymous.
   HTTP header	The HTTP request header name and value. Multiple headers can be added.
   +	Click to add another action. Actions can be reorganized as needed by dragging and dropping.

6. Click OK.

To configure an Azure function automation stitch in the CLI:

1. Create an automation action:

   config system automation-action
       edit "azure_function"
           set action-type azure-function
           set azure-app "liang01-no-delete-jlum"
           set azure-function "headersResponse"
           set azure-function-authorization function
           set azure-api-key xxxxxx
           set headers "header1:value1" "header2:value2"
       next
   end

2. Create an automation trigger:

   config system automation-trigger
       edit "auto-azure"
           set event-type security-rating-summary
       next
   end

3. Create the automation stitch:

   config system automation-stitch
       edit "auto-azure"
           set trigger "auto-azure"
           set action "azure_function"
       next
   end

When the automation stitch is triggered, the FortiGate shows the stitch trigger time:

In Azure, the function log shows that the function was called, executed, and finished: