CounterMeasures are automated responses (actions) to incidents that are triggered in your infrastructure. They can be simple, such as attaching a top output to your incident; or, they can be more complex, like making an API call or restarting a service when a threshold is crossed. At its core, CounterMeasures is an extensible platform that allows you to increase the level of automation within your operations workflow - either by using the out of the box FortiMonitor CounterMeasures or by writing your own.

CounterMeasures can be run from an Agent (Linux/ Windows) or an OnSight vCollector.

A simple example

The CounterMeasures workflow is quite simple and is driven by the FortiMonitor monitoring agent.

1. Enable CounterMeasures (Linux | Windows) in your agent config file or manifest file.

2. Add a CounterMeasure to a metric threshold, such as Disk % used.

3. If the threshold is crossed, the CounterMeasure will be run.

Any output provided by the CounterMeasure will be attached to the incident record and will be available in the FortiMonitor control panel, in the incident log, and Slack.

Next steps

• Learn more about enabling CounterMeasures on your instances (Linux | Windows)

• Check out the actions that come with CounterMeasures out of the box (Linux | Windows )

• Dive into writing your custom CounterMeasure actions (Linux | Windows)