FortiAnalyzer event handler trigger

You can trigger automation stitches based on FortiAnalyzer event handlers. This allows you to define rules based on complex correlations across devices, log types, frequencies, and other criteria.

To set up a FortiAnalyzer event handler trigger:

1. Configure a FortiGate event handler on the FortiAnalyzer
2. Configure FortiAnalyzer logging on the FortiGate
3. Configure an automation stitch that is triggered by a FortiAnalyzer event handler

Configure a FortiGate event handler on the FortiAnalyzer

On the FortiAnalyzer, configure an event handler for the automation stitch. In this example, the event handler is triggered when an administrator logs in to the FortiGate.

To configure an event handler on the FortiAnalyzer:

1. Go to Incidents & Events > Handlers > FortiGate Event Handlers.
2. Configure an event handler for the automation stitch.

   

3. Click OK.

Configure FortiAnalyzer logging on the FortiGate

See Configuring FortiAnalyzer for more information.

To configure FortiAnalyzer logging in the GUI:

1. Go to Security Fabric > Fabric Connectors and double-click the FortiAnalyzer Logging card.
2. Click Enabled and configure the settings as needed.
3. Click OK.

To configure FortiAnalyzer logging in the CLI:

config log fortianalyzer setting
    set status enable
    set server "10.6.30.250"
    set serial "FL-4HET318900407"
    set upload-option realtime
    set reliable enable
end

Configure an automation stitch that is triggered by a FortiAnalyzer event handler

When a FortiAnalyzer event handler is triggered, it sends a notification to the FortiGate automation framework, which generates a log and triggers the automation stitch.

To configure an automation stitch that is triggered by a FortiAnalyzer event handler in the GUI:

1. Go to Security Fabric > Automation.
2. Click Create New.
3. In the Trigger section, select FortiAnalyzer Event Handler.
4. Set Event handler name to the event that was created on the FortiAnalyzer.
5. Set the Event severity, and select or create an Event tag.

   

6. In the Action section, select Email and configure the email recipient and message.
7. Click OK.

To configure an automation stitch that is triggered by a FortiAnalyzer event handler in the CLI:

1. Create an automation action:

   config system automation-action
       edit "auto-faz-1_email"
           set action-type email
           set email-to "jnjssll@fortinet.com"
           set email-subject "CSF stitch alert"
           set message "User login FortiGate successfully."
       next
   end

2. Create an automation trigger:

   config system automation-trigger
       edit "auto-faz-1"
           set event-type faz-event
           set faz-event-name "system-log-handler2"
           set faz-event-severity "medium"
           set faz-event-tags "User login successfully"
       next
   end

3. Create the automation stitch:

   config system automation-stitch
       edit "auto-faz-1"
           set trigger "auto-faz-1"
           set action "auto-faz-1_email"
       next
   end

View the trigger event log

To see the trigger event log in the GUI:

1. Log in to the FortiGate.

   The FortiAnalyzer sends notification to the FortiGate automation framework, generates an event log on the FortiGate, and triggers the automation stitch.

2. Go to Log & Report > Events and select System Events.

   

To see event logs in the CLI:

execute log display
    ...
    date=2019-02-05 time=14:16:17 logid="0100046600" type="event" subtype="system" level="notice" vd="root" eventtime=1549404977 logdesc="Automation stitch triggered" stitch="auto-faz-1" trigger="auto-faz-1" from="log" msg="stitch:auto-faz-1 is triggered."
    ...

Sample email

The email sent by the action will look similar to the following: