Default automation stitches

The following default automation stitches are included in FortiOS:

• Compromised Host Quarantine

• Firmware upgrade notification

• FortiAnalyzer Connection Down

• Network Down

• HA Failover

• Incoming Webhook Quarantine

• License Expired Notification

• Reboot

• Security Rating Notification

To view and edit the automation stitches in the GUI, go to Security Fabric > Automation.

CLI configurations

Compromised Host Quarantine

config system automation-action
    edit "Access Layer Quarantine"
        set description "Quarantine the MAC address on access layer devices (FortiSwitch and FortiAP)."
        set action-type quarantine
    next
    edit "FortiClient Quarantine"
        set description "Use FortiClient EMS to quarantine the endpoint device."
        set action-type quarantine-forticlient
    next
end

config system automation-trigger
    edit "Compromised Host"
        set description "An incident of compromise has been detected on a host endpoint."
    next
end

config system automation-stitch
    edit "Compromised Host Quarantine"
        set description "Quarantine a compromised host on FortiAPs, FortiSwitches, and FortiClient EMS."
        set status disable
        set trigger "Compromised Host"
        config actions
            edit 1
                set action "Access Layer Quarantine"
            next
            edit 2
                set action "FortiClient Quarantine"
            next
        end
    next
end

Firmware upgrade notification

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Auto Firmware upgrade"
        set description "Automatic firmware upgrade."
        set trigger-type event-based
        set event-type event-log
        set logid 22094 22095 32263
    next 
end

config system automation-stitch
    edit "Firmware upgrade notification"
        set description "Automatic firmware upgrade notification."
        set status enable
        set trigger "Auto Firmware upgrade"
        config actions
            edit 1
                set action "Email Notification"
                set delay 0
                set required disable
            next
        end
    next
end

FortiAnalyzer Connection Down

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "FortiAnalyzer Connection Down"
        set description "A FortiAnalyzer connection is down."
        set event-type event-log
        set logid 22902
    next
end

config system automation-stitch
    edit "FortiAnalyzer Connection Down"
        set description "Send a email notification when the connection to FortiAnalyzer is lost."
        set status disable
        set trigger "FortiAnalyzer Connection Down"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Network Down

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Network Down"
        set description "A network connection is down."
        set event-type event-log
        set logid 20099
        config fields
            edit 1
                set name "status"
                set value "DOWN"
            next
        end
    next
end

config system automation-stitch
    edit "Network Down"
        set description "Send an email when a network goes down."
        set status disable
        set trigger "Network Down"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

HA Failover

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "HA Failover"
        set description "A HA failover has occurred."
        set event-type ha-failover
    next
end

config system automation-stitch
    edit "HA Failover"
        set description "Send an email when a HA failover is detected."
        set status disable
        set trigger "HA Failover"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Incoming Webhook Quarantine

config system automation-action
    edit "Access Layer Quarantine"
        set description "Quarantine the MAC address on access layer devices (FortiSwitch and FortiAP)."
        set action-type quarantine
    next
    edit "FortiClient Quarantine"
        set description "Use FortiClient EMS to quarantine the endpoint device."
        set action-type quarantine-forticlient
    next
end

config system automation-trigger
    edit "Incoming Webhook Call"
        set description "An incoming webhook call is received"
        set event-type incoming-webhook
    next
end

config system automation-stitch
    edit "Incoming Webhook Quarantine"
        set description "Quarantine a provided MAC address on FortiAPs, FortiSwitches, and FortiClient EMS using an Incoming Webhook."
        set status disable
        set trigger "Incoming Webhook Call"
        config actions
            edit 1
                set action "Access Layer Quarantine"
            next
            edit 2
                set action "FortiClient Quarantine"
            next
        end
    next 
end

License Expired Notification

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "License Expiry"
        set description "A FortiGate license is near expiration."
        set event-type license-near-expiry
        set license-type any
    next
end

config system automation-stitch
    edit "License Expired Notification"
        set description "Send a email notification when a license is near expiration."
        set status disable
        set trigger "License Expiry"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next

Reboot

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Reboot"
        set description "A FortiGate is rebooted."
        set event-type reboot
    next
end

config system automation-stitch
    edit "Reboot"
        set description "Send an email when a FortiGate is rebooted."
        set status disable
        set trigger "Reboot"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Security Rating Notification

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Any Security Rating Notification"
        set description "A security rating summary report has been generated."
        set event-type security-rating-summary
        set report-type any
    next 
end

config system automation-stitch
    edit "Security Rating Notification"
        set description "Send a email notification when a new Security Rating report is available."
        set status disable
        set trigger "Any Security Rating Notification"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end