Fortinet Document Library

Version:


Table of Contents

New Features

7.0.0
Download PDF
Copy Link

Automation workflow improvements

This redesign simplifies the workflow for managing multiple chained actions, and makes it clearer which order the actions will be processed in. The enhancements include:

GUI changes to Automation page

Automation stitches, actions, and triggers have separate dialogs and are no longer part of the main stitch dialog. When creating a stitch, clicking Add Trigger and Add Action displays a list of available triggers and actions, and the option to create a new one.

Once the stitch is configured, a process diagram of the trigger, actions, and delays is displayed.

Tabs on the Automation page

On the Security Fabric > Automation page, there are tabs for Stitch, Trigger, and Action. The Stitch tab is the default view that lists the trigger and actions used in each stitch. Individual triggers and actions can be created or edited in the corresponding tabs.

Click Trigger to view the list of triggers.

Click Action to view the list of actions.

The following example shows how to configure a Security Rating Summary automation stitch with AWS Lambda and Email actions.

To configure the automation stitch in the GUI:
  1. Go to Security Fabric > Automation and click Create New.
  2. Enter the stitch name and description.
  3. Configure the trigger:
    1. Click Add Trigger.
    2. Click Create and select Security Rating Summary.
    3. Enter the following:

      Name

      aws_no_delay

      Report

      Security Posture

    4. Click OK.
    5. Select the trigger in the list and click Apply.
  4. Configure the AWS Lambda function action:
    1. Click Add Action.
    2. Click Create and select AWS Lambda.
    3. Enter the following:

      Name

      aws_no_delay

      URL

      Enter the request API URI

      API key

      Enter AWS API gateway API key

      HTTP header

      header2 : header2_value

    4. Click OK.
    5. Select the action in the list and click Apply.
  5. Configure the Email notification action:
    1. Click Add Action.
    2. Click Create and select Email.
    3. Enter the following:

      Name

      email_action

      Delay

      60

      To

      Enter an email address

      Subject

      email action for test

      Replacement message

      Enable

    4. Click OK.
    5. Select the action in the list and click Apply.
  6. Click OK.
To configure the automation stitch in the CLI:
  1. Configure the trigger:
    config system automation-trigger
        edit "aws_no_delay"
            set event-type security-rating-summary
        next
    end
  2. Configure the actions:
    config system automation-action
        edit "aws_no_delay"
            set action-type aws-lambda
            set aws-api-key xxxxxxxxxxxx
            set uri "xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/xxxxxxxxxx"
            set headers "header2:header2_value"
        next
        edit "email_action"
            set description "email action for test"
            set action-type email
            set email-to "test@fortinet.com"
            set email-subject "email action for test"
            set delay 60
            set replacement-message enable
        next
    end
  3. Configure the stitch:
    config system automation-stitch
        edit "aws_no_delay"
            set description "aws action test"
            set trigger "aws_no_delay"
            set action "aws_no_delay" "email_action"
        next
    end

FortiOS Event Log trigger

To configure a FortiOS Event Log trigger in the GUI:
  1. Go to Security Fabric > Automation and click Create New.
  2. Enter the stitch name and description.
  3. Configure the trigger:
    1. Click Add Trigger.
    2. Click Create and select FortiOS Event Log.
    3. Enter a name and description.
    4. In the Event field, click the + to select multiple event log IDs.
    5. In the Field filter(s) field, click the + to add multiple field filters. The configured filters much match in order for the stitch to be triggered.

    6. Click OK.
    7. Select the trigger in the list and click Apply.
  4. Configure the rest of the stitch as needed.
To configure a FortiOS Event Log trigger in the CLI:
config system automation-trigger
    edit "event_login_logout"
        set description "trigger for login logout event"
        set event-type event-log
        set logid 32001 32003
        config fields
            edit 1
                set name "user"
                set value "csf"
            next
            edit 2
                set name "ip"
                set value "10.6.30.254"
            next
        end
    next
end

Any report type for Security Rating Summary trigger

To configure a Security Rating Summary trigger in the GUI:
  1. Go to Security Fabric > Automation and click Create New.
  2. Enter the stitch name and description.
  3. Configure the trigger:
    1. Click Add Trigger.
    2. Click Create and select Security Rating Summary.
    3. Enter a name and description.
    4. In the Report field, select Any.

    5. Click OK.
    6. Select the trigger in the list and click Apply.
  4. Configure the rest of the stitch as needed.
To configure a Security Rating Summary trigger in the CLI:
config system automation-trigger
    edit "rating_any"
        set description "rating any type"
        set event-type security-rating-summary
        set report-type any
    next
end

URI configuration for cloud actions

For AWS Lambda, Google Cloud, Azure, and AliCloud functions, the URI has been combined into a single attribute instead of having separate attributes for each URI path segment. In the GUI, use the URL field. In the CLI, use the set uri parameter.

JSON option for Slack and Microsoft Teams notifications

Users have the option to select either a text or JSON message for Slack and Microsoft Teams notifications. The following example shows how to configure a Slack notification with a JSON message.

To configure a Slack notification action with a JSON message in the GUI:
  1. Go to Security Fabric > Automation and click the Action tab.
  2. Click Create New and select Slack Notification.
  3. For Message, select JSON, and enter the message in the text box.
  4. Configure the other settings as needed.

  5. Click OK.
To configure a Slack notification action with a JSON message in the CLI:
config system automation-action
    edit "slack_json"
        set action-type slack-notification
        set delay 30
        set message-type json
        set uri "hooks.slack.com/services/xxxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx"
        set http-body "{\'text\':\'%%log%%\'}"
    next
end

FortiExplorer notification

To configure a FortiExplorer notification action in the GUI:
  1. Go to Security Fabric > Automation and click the Action tab.
  2. Click Create New and select FortiExplorer Notification.
  3. Configure the settings as needed.

  4. Click OK.
To configure a FortiExplorer notification action in the CLI:
config system automation-action
    edit "fortiexplore_notification1"
        set description "fortiexplore_notification action"
        set action-type fortiexplorer-notification
    next
end

Automation workflow improvements

This redesign simplifies the workflow for managing multiple chained actions, and makes it clearer which order the actions will be processed in. The enhancements include:

GUI changes to Automation page

Automation stitches, actions, and triggers have separate dialogs and are no longer part of the main stitch dialog. When creating a stitch, clicking Add Trigger and Add Action displays a list of available triggers and actions, and the option to create a new one.

Once the stitch is configured, a process diagram of the trigger, actions, and delays is displayed.

Tabs on the Automation page

On the Security Fabric > Automation page, there are tabs for Stitch, Trigger, and Action. The Stitch tab is the default view that lists the trigger and actions used in each stitch. Individual triggers and actions can be created or edited in the corresponding tabs.

Click Trigger to view the list of triggers.

Click Action to view the list of actions.

The following example shows how to configure a Security Rating Summary automation stitch with AWS Lambda and Email actions.

To configure the automation stitch in the GUI:
  1. Go to Security Fabric > Automation and click Create New.
  2. Enter the stitch name and description.
  3. Configure the trigger:
    1. Click Add Trigger.
    2. Click Create and select Security Rating Summary.
    3. Enter the following:

      Name

      aws_no_delay

      Report

      Security Posture

    4. Click OK.
    5. Select the trigger in the list and click Apply.
  4. Configure the AWS Lambda function action:
    1. Click Add Action.
    2. Click Create and select AWS Lambda.
    3. Enter the following:

      Name

      aws_no_delay

      URL

      Enter the request API URI

      API key

      Enter AWS API gateway API key

      HTTP header

      header2 : header2_value

    4. Click OK.
    5. Select the action in the list and click Apply.
  5. Configure the Email notification action:
    1. Click Add Action.
    2. Click Create and select Email.
    3. Enter the following:

      Name

      email_action

      Delay

      60

      To

      Enter an email address

      Subject

      email action for test

      Replacement message

      Enable

    4. Click OK.
    5. Select the action in the list and click Apply.
  6. Click OK.
To configure the automation stitch in the CLI:
  1. Configure the trigger:
    config system automation-trigger
        edit "aws_no_delay"
            set event-type security-rating-summary
        next
    end
  2. Configure the actions:
    config system automation-action
        edit "aws_no_delay"
            set action-type aws-lambda
            set aws-api-key xxxxxxxxxxxx
            set uri "xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/xxxxxxxxxx"
            set headers "header2:header2_value"
        next
        edit "email_action"
            set description "email action for test"
            set action-type email
            set email-to "test@fortinet.com"
            set email-subject "email action for test"
            set delay 60
            set replacement-message enable
        next
    end
  3. Configure the stitch:
    config system automation-stitch
        edit "aws_no_delay"
            set description "aws action test"
            set trigger "aws_no_delay"
            set action "aws_no_delay" "email_action"
        next
    end

FortiOS Event Log trigger

To configure a FortiOS Event Log trigger in the GUI:
  1. Go to Security Fabric > Automation and click Create New.
  2. Enter the stitch name and description.
  3. Configure the trigger:
    1. Click Add Trigger.
    2. Click Create and select FortiOS Event Log.
    3. Enter a name and description.
    4. In the Event field, click the + to select multiple event log IDs.
    5. In the Field filter(s) field, click the + to add multiple field filters. The configured filters much match in order for the stitch to be triggered.

    6. Click OK.
    7. Select the trigger in the list and click Apply.
  4. Configure the rest of the stitch as needed.
To configure a FortiOS Event Log trigger in the CLI:
config system automation-trigger
    edit "event_login_logout"
        set description "trigger for login logout event"
        set event-type event-log
        set logid 32001 32003
        config fields
            edit 1
                set name "user"
                set value "csf"
            next
            edit 2
                set name "ip"
                set value "10.6.30.254"
            next
        end
    next
end

Any report type for Security Rating Summary trigger

To configure a Security Rating Summary trigger in the GUI:
  1. Go to Security Fabric > Automation and click Create New.
  2. Enter the stitch name and description.
  3. Configure the trigger:
    1. Click Add Trigger.
    2. Click Create and select Security Rating Summary.
    3. Enter a name and description.
    4. In the Report field, select Any.

    5. Click OK.
    6. Select the trigger in the list and click Apply.
  4. Configure the rest of the stitch as needed.
To configure a Security Rating Summary trigger in the CLI:
config system automation-trigger
    edit "rating_any"
        set description "rating any type"
        set event-type security-rating-summary
        set report-type any
    next
end

URI configuration for cloud actions

For AWS Lambda, Google Cloud, Azure, and AliCloud functions, the URI has been combined into a single attribute instead of having separate attributes for each URI path segment. In the GUI, use the URL field. In the CLI, use the set uri parameter.

JSON option for Slack and Microsoft Teams notifications

Users have the option to select either a text or JSON message for Slack and Microsoft Teams notifications. The following example shows how to configure a Slack notification with a JSON message.

To configure a Slack notification action with a JSON message in the GUI:
  1. Go to Security Fabric > Automation and click the Action tab.
  2. Click Create New and select Slack Notification.
  3. For Message, select JSON, and enter the message in the text box.
  4. Configure the other settings as needed.

  5. Click OK.
To configure a Slack notification action with a JSON message in the CLI:
config system automation-action
    edit "slack_json"
        set action-type slack-notification
        set delay 30
        set message-type json
        set uri "hooks.slack.com/services/xxxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx"
        set http-body "{\'text\':\'%%log%%\'}"
    next
end

FortiExplorer notification

To configure a FortiExplorer notification action in the GUI:
  1. Go to Security Fabric > Automation and click the Action tab.
  2. Click Create New and select FortiExplorer Notification.
  3. Configure the settings as needed.

  4. Click OK.
To configure a FortiExplorer notification action in the CLI:
config system automation-action
    edit "fortiexplore_notification1"
        set description "fortiexplore_notification action"
        set action-type fortiexplorer-notification
    next
end