Fortinet FortiGate v5.2.3

About the connector

Fortinet FortiGate enterprise firewall provide high performance, consolidated advanced security and granular visibility for broad protection across the entire digital attack surface.

This document provides information about the Fortinet FortiGate Connector, which facilitates automated interactions, with a Fortinet FortiGate server using FortiSOAR™ playbooks. Add the Fortinet FortiGate Connector as a step in FortiSOAR™ playbooks and perform automated operations with Fortinet FortiGate.

Version information

Connector Version: 5.2.3

FortiSOAR™ Version Tested on: 7.4.0-3024

Fortinet FortiGate Version Tested on: FortiGate VM64 v7.2.3 build1262

Authored By: Fortinet

Certified: Yes

Release Notes for version 5.2.3

Following enhancements have been made to the Fortinet FortiGate Connector in version 5.2.3:

• Added support for policy based blocking and unblocking IP addresses.
• Added NGFW Mode parameter in following actions:
  • Get Blocked IP Addresses
  • Block IP Address
  • Unblock IP Address
  • Get List of Policies
• Added a new Never option for Time to Live parameter in Block IP Address action to ban IP addresses permanently.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-fortigate-firewall

Prerequisites to configuring the connector

• You must have the IP address or Hostname of the Fortinet FortiGate server to connect and perform the automated operations and the API Key to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on Fortinet FortiGate.
• To block or unblock IP addresses, URLs, or applications, you need to add the necessary configuration to Fortinet FortiGate. See the Blocking or Unblocking IP addresses, URLs, or applications on Fortinet FortiGate section.
• VDOM is configured using a network interface in FortiGate which has its own IP address with different subnets (separate from global or root VDOM). When users select VDOM in the connector Configuration, users should specify the VDOM interface IP in the Hostname section, otherwise, an Unauthorized Error is encountered. See the following screenshots for VDOM-specific connector configuration:
  
  
  

Minimum Permissions Required

• Ensure the user has the permissions required for the actions you wish to perform on Fortinet FortiGate.
• To execute Fortinet FortiGate connector actions, the following minimal profile permissions are required:
  • User and Device: Read and Write permissions.
  • Firewall: Read and Write permissions for Policy, Address, and Service.
  • Security Profile: Read and Write permissions for Web Filter and Application Control.
  • Security Fabric - Read and Write permissions.
  • WiFi & Switch - Read and Write permissions.
  • Log & Report - Read and Write permissions.

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Fortinet FortiGate connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 and onwards:

operation: Get Applications Detail

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "http_status": "",
    "http_method": "",
    "results": [
        {
            "q_origin_key": "",
            "q_name": "",
            "protocol": "",
            "q_type": "",
            "q_path": "",
            "id": "",
            "category": "",
            "q_ref": "",
            "q_no_rename": "",
            "sub-category": "",
            "risk": "",
            "metadata": [
                {
                    "id": "",
                    "q_origin_key": "",
                    "metaid": "",
                    "valueid": ""
                }
            ],
            "q_static": "",
            "technology": "",
            "vendor": "",
            "weight": "",
            "popularity": "",
            "q_mkey_type": "",
            "q_class": "",
            "behavior": "",
            "name": "",
            "parameter": ""
        }
    ],
    "vdom": "",
    "build": "",
    "serial": "",
    "version": "",
    "name": "",
    "revision": "",
    "path": ""
}

operation: Get Blocked IP Addresses

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Block Method as Quarantine Based:

{
    "vdom_not_exist": [],
    "result": [
        {
            "name": "",
            "version": "",
            "vdom": "",
            "serial": "",
            "results": [
                {
                    "ipv6": "",
                    "source": "",
                    "created": "",
                    "ip_address": "",
                    "expires": ""
                }
            ],
            "build": "",
            "http_method": "",
            "status": "",
            "path": ""
        }
    ]
}

Output schema when you choose Block Method as Policy Based:

{
    "policy_name": "",
    "srcaddr": [],
    "dstaddr": [],
    "addrgrp": [
        {
            "name": "",
            "member": []
        }
    ],
    "addrgrp_not_exist": []
}

operation: Get Blocked Applications

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "name": "",
    "risk": "",
    "q_ref": "",
    "q_name": "",
    "q_path": "",
    "q_type": "",
    "vendor": "",
    "weight": "",
    "q_class": "",
    "behavior": "",
    "category": "",
    "metadata": [
        {
            "id": "",
            "metaid": "",
            "valueid": "",
            "q_origin_key": ""
        }
    ],
    "protocol": "",
    "q_static": true,
    "parameter": "",
    "popularity": "",
    "technology": "",
    "q_mkey_type": "",
    "q_no_rename": false,
    "q_origin_key": "",
    "sub-category": "",
    "q_global_entry": ""
}

operation: Get Blocked URLs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "type": "",
    "id": "",
    "action": "",
    "status": "",
    "url": "",
    "q_origin_key": "",
    "exempt": "",
    "referrer-host": "",
    "web-proxy-profile": "",
    "dns-address-family": ""
}

operation: Block IP Address

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Block Method as Quarantine Based:

{
    "newly_blocked": [],
    "vdom_not_exist": [],
    "already_blocked": [],
    "error_with_block": []
}

Output schema when you choose Block Method as Policy Based:

{
    "already_blocked": [],
    "newly_blocked": [],
    "error_with_block": []
}

operation: Block Application

Input parameters

Output

The output contains the following populated JSON schema:

{
    "name": "",
    "status": "",
    "message": ""
}

operation: Block URL

Input parameters

Output

The output contains the following populated JSON schema:

{
    "already_blocked": [],
    "newly_blocked": [],
    "not_block": []
}

operation: Unblock IP Address

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when you choose Unblock Method as Quarantine Based:

{
    "newly_unblocked": [],
    "ip_not_exist": [],
    "vdom_not_exist": [],
    "error_with_unblock": []
}

Output schema when you choose Unblock Method as Policy Based:

{
    "not_exist": [],
    "newly_unblocked": [],
    "error_with_unblock": []
}

operation: Unblock Application

Input parameters

Output

The output contains the following populated JSON schema:

{
    "name": "",
    "status": "",
    "message": ""
}

operation: Unblock URL

Input parameters

Output

The output contains the following populated JSON schema:

{
    "not_exist": [],
    "newly_unblocked": [],
    "not_unblock": []
}

operation: Quarantine Host

Input parameters

Output

The output contains the following populated JSON schema:

{
    "already_quarantine": [],
    "newly_quarantine": [],
    "not_quarantine": []
}

operation: Unquarantine Host

Input parameters

Output

The output contains the following populated JSON schema:

{
    "not_exist": [],
    "newly_unquarantine": [],
    "not_unquarantine": []
}

operation: Get Quarantine Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "results": {
        "targets": [
            {
                "macs": [
                    {
                        "mac": "",
                        "drop": "",
                        "parent": "",
                        "entry-id": "",
                        "description": "",
                        "q_origin_key": ""
                    }
                ],
                "entry": "",
                "description": "",
                "q_origin_key": ""
            }
        ],
        "quarantine": "",
        "traffic-policy": "",
        "firewall-groups": ""
    },
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": ""
}

operation: Create Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "old_revision": "",
    "revision_changed": ""
}

operation: Get Addresses

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "results": [
        {
            "name": "",
            "q_origin_key": "",
            "uuid": "",
            "subnet": "",
            "type": "",
            "sub-type": "",
            "clearpass-spt": "",
            "start-mac": "",
            "end-mac": "",
            "country": "",
            "cache-ttl": "",
            "sdn": "",
            "fsso-group": [],
            "interface": "",
            "obj-type": "",
            "comment": "",
            "associated-interface": "",
            "color": "",
            "filter": "",
            "sdn-addr-type": "",
            "obj-id": "",
            "list": [],
            "tagging": [],
            "allow-routing": "",
            "fabric-object": ""
        }
    ],
    "vdom": "",
    "path": "",
    "name": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Update Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "old_revision": "",
    "revision_changed": ""
}

operation: Delete Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "old_revision": "",
    "revision_changed": ""
}

operation: Create Address Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Get Address Groups

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "results": [
        {
            "name": "",
            "q_origin_key": "",
            "type": "",
            "uuid": "",
            "member": [
                {
                    "name": "",
                    "q_origin_key": ""
                },
                {
                    "name": "",
                    "q_origin_key": ""
                },
                {
                    "name": "",
                    "q_origin_key": ""
                }
            ],
            "comment": "",
            "exclude": "",
            "exclude-member": [],
            "color": "",
            "tagging": [],
            "allow-routing": "",
            "fabric-object": ""
        }
    ],
    "vdom": "",
    "path": "",
    "name": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Update Address Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Delete Address Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Create Service

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Get Services

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "results": [
        {
            "name": "",
            "q_origin_key": "",
            "proxy": "",
            "category": "",
            "protocol": "",
            "helper": "",
            "iprange": "",
            "fqdn": "",
            "tcp-portrange": "",
            "udp-portrange": "",
            "sctp-portrange": "",
            "tcp-halfclose-timer": "",
            "tcp-halfopen-timer": "",
            "tcp-timewait-timer": "",
            "udp-idle-timer": "",
            "session-ttl": "",
            "check-reset-range": "",
            "comment": "",
            "color": "",
            "visibility": "",
            "app-service-type": "",
            "app-category": [],
            "application": [],
            "fabric-object": ""
        }
    ],
    "vdom": "",
    "path": "",
    "name": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Update Service

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Delete Service

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Create Service Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Get Service Groups

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "results": [
        {
            "name": "",
            "q_origin_key": "",
            "proxy": "",
            "member": [
                {
                    "name": "",
                    "q_origin_key": ""
                }
            ],
            "comment": "",
            "color": "",
            "fabric-object": ""
        }
    ],
    "vdom": "",
    "path": "",
    "name": "",
    "status": "",
    "http_status": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Update Service Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Delete Service Group

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Create Policy

Input parameters

    {
        "field1": value1,
        "field2": value2
    }
                

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Get List of Policies

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": [
        {
            "status": "",
            "path": "",
            "revision": "",
            "name": "",
            "http_method": "",
            "vdom": "",
            "http_status": "",
            "version": "",
            "build": "",
            "serial": "",
            "results": [
                {
                    "logtraffic": "",
                    "srcaddr": [
                        {
                            "q_origin_key": "",
                            "name": ""
                        }
                    ],
                    "dstintf": [
                        {
                            "q_origin_key": "",
                            "name": ""
                        }
                    ],
                    "label": "",
                    "scan-botnet-connections": "",
                    "action": "",
                    "capture-packet": "",
                    "ips-sensor": "",
                    "tcp-session-without-syn": "",
                    "av-profile": "",
                    "policyid": "",
                    "diffserv-reverse": "",
                    "dnsfilter-profile": "",
                    "send-deny-packet": "",
                    "profile-protocol-options": "",
                    "app-category": [],
                    "vlan-cos-fwd": "",
                    "diffserv-forward": "",
                    "wanopt-passive-opt": "",
                    "tags": [],
                    "custom-log-fields": [],
                    "voip-profile": "",
                    "users": [],
                    "srcintf": [
                        {
                            "q_origin_key": "",
                            "name": ""
                        }
                    ],
                    "learning-mode": "",
                    "timeout-send-rst": "",
                    "wsso": "",
                    "fsso": "",
                    "spamfilter-profile": "",
                    "traffic-shaper-reverse": "",
                    "url-category": [],
                    "block-notification": "",
                    "rsso": "",
                    "internet-service": "",
                    "internet-service-custom": [],
                    "webfilter-profile": "",
                    "dsri": "",
                    "auth-cert": "",
                    "ssl-mirror": "",
                    "groups": [],
                    "diffservcode-forward": "",
                    "internet-service-id": [],
                    "firewall-session-dirty": "",
                    "tcp-mss-sender": "",
                    "dstaddr-negate": "",
                    "outbound": "",
                    "rtp-nat": "",
                    "dscp-value": "",
                    "profile-type": "",
                    "wccp": "",
                    "inbound": "",
                    "ssl-mirror-intf": [],
                    "service": [
                        {
                            "q_origin_key": "",
                            "name": ""
                        }
                    ],
                    "webcache": "",
                    "service-negate": "",
                    "wanopt": "",
                    "dscp-negate": "",
                    "profile-group": "",
                    "status": "",
                    "q_origin_key": "",
                    "tcp-mss-receiver": "",
                    "rtp-addr": [],
                    "nat": "",
                    "utm-status": "",
                    "poolname": [],
                    "fsso-agent-for-ntlm": "",
                    "delay-tcp-npu-session": "",
                    "ntlm": "",
                    "permit-stun-host": "",
                    "vpntunnel": "",
                    "devices": [],
                    "schedule": "",
                    "permit-any-host": "",
                    "global-label": "",
                    "icap-profile": "",
                    "dlp-sensor": "",
                    "identity-based-route": "",
                    "logtraffic-start": "",
                    "redirect-url": "",
                    "session-ttl": "",
                    "diffservcode-rev": "",
                    "auth-path": "",
                    "disclaimer": "",
                    "application": [],
                    "name": "",
                    "wanopt-profile": "",
                    "schedule-timeout": "",
                    "internet-service-negate": "",
                    "traffic-shaper": "",
                    "ippool": "",
                    "wanopt-detection": "",
                    "natoutbound": "",
                    "webcache-https": "",
                    "fixedport": "",
                    "application-list": "",
                    "waf-profile": "",
                    "dstaddr": [
                        {
                            "q_origin_key": "",
                            "name": ""
                        }
                    ],
                    "comments": "",
                    "srcaddr-negate": "",
                    "replacemsg-override-group": "",
                    "uuid": "",
                    "vlan-cos-rev": "",
                    "radius-mac-auth-bypass": "",
                    "wanopt-peer": "",
                    "natip": "",
                    "per-ip-shaper": "",
                    "dscp-match": "",
                    "ntlm-enabled-browsers": [],
                    "ntlm-guest": "",
                    "natinbound": "",
                    "captive-portal-exempt": "",
                    "match-vip": "",
                    "ssl-ssh-profile": "",
                    "auth-redirect-addr": ""
                }
            ]
        }
    ],
    "vdom_not_exist": []
}

operation: Update Policy

Input parameters

    
    {
        "field1": value1,
        "field2": value2
    }
                

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "revision": "",
    "revision_changed": "",
    "old_revision": "",
    "mkey": "",
    "status": "",
    "http_status": "",
    "vdom": "",
    "path": "",
    "name": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Delete Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "old_revision": "",
    "revision_changed": ""
}

operation: Execute Command

Input parameters

Output

The output contains the following populated JSON schema:

{
    "command": "",
    "output": []
}

operation: Create User

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "old_revision": "",
    "revision_changed": ""
}

operation: Get Users

Input parameters

Output

The output contains the following populated JSON schema:

{
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "results": [
        {
            "id": "",
            "name": "",
            "type": "",
            "q_ref": "",
            "passwd": "",
            "q_name": "",
            "q_path": "",
            "q_type": "",
            "status": "",
            "q_class": "",
            "email-to": "",
            "q_static": "",
            "css-class": "",
            "q_no_edit": "",
            "sms-phone": "",
            "fortitoken": {
                "datasource": "",
                "q_origin_key": "",
                "serial-number": ""
            },
            "ppk-secret": "",
            "sms-server": "",
            "two-factor": "",
            "authtimeout": "",
            "ldap-server": "",
            "passwd-time": "",
            "q_mkey_type": "",
            "q_no_rename": "",
            "workstation": "",
            "ppk-identity": "",
            "q_origin_key": "",
            "passwd-policy": "",
            "radius-server": "",
            "q_global_entry": "",
            "tacacs+-server": {
                "name": "",
                "datasource": "",
                "q_origin_key": ""
            },
            "sms-custom-server": "",
            "auth-concurrent-value": "",
            "two-factor-notification": "",
            "auth-concurrent-override": "",
            "two-factor-authentication": "",
            "username-case-sensitivity": ""
        }
    ],
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": ""
}

operation: Update User

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "revision_changed": ""
}

operation: Delete User

Input parameters

Output

The output contains the following populated JSON schema:

{
    "mkey": "",
    "name": "",
    "path": "",
    "vdom": "",
    "build": "",
    "serial": "",
    "status": "",
    "version": "",
    "revision": "",
    "http_method": "",
    "http_status": "",
    "old_revision": "",
    "revision_changed": ""
}

operation: Get System Events

Input parameters

Output

The output contains the following populated JSON schema:

{
    "http_method": "",
    "results": [
        {
            "date": "",
            "time": "",
            "eventtime": "",
            "tz": "",
            "logid": "",
            "type": "",
            "subtype": "",
            "level": "",
            "vd": "",
            "logdesc": "",
            "user": "",
            "action": "",
            "msg": "",
            "_metadata": {
                "#": "",
                "logid": "",
                "timestamp": "",
                "roll": ""
            }
        }
    ],
    "vdom": "",
    "device": "",
    "category": "",
    "subcategory": "",
    "start": "",
    "rows": "",
    "session_id": "",
    "completed": "",
    "total_lines": "",
    "now": "",
    "status": "",
    "serial": "",
    "version": "",
    "build": ""
}

operation: Get User Last Login Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "date": "",
    "time": "",
    "eventtime": "",
    "tz": "",
    "logid": "",
    "type": "",
    "subtype": "",
    "level": "",
    "vd": "",
    "logdesc": "",
    "sn": "",
    "user": "",
    "ui": "",
    "method": "",
    "srcip": "",
    "dstip": "",
    "action": "",
    "status": "",
    "reason": "",
    "profile": "",
    "msg": "",
    "_metadata": {
        "#": "",
        "logid": "",
        "timestamp": "",
        "roll": ""
    }
}

Included playbooks

The Sample - Fortinet FortiGate - 5.2.3 playbook collection comes bundled with the Fortinet FortiGate connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR^TM after importing the Fortinet FortiGate connector.

• Address Group: Create Address Group
• Address Group: Delete Address Group
• Address Group: Get Address Groups
• Address Group: Update Address Group
• Address: Block IP Address
• Address: Create Address
• Address: Delete Address
• Address: Get Addresses
• Address: Get Blocked IP Addresses
• Address: Unblock IP Address
• Address: Update Address
• Application: Block Application
• Application: Get Applications Detail
• Application: Get Blocked Applications
• Application: Unblock Application
• Execute Command
• Get System Events
• Host: Get Quarantine Hosts
• Host: Quarantine Host
• Host: Unquarantine Host
• Policy: Create Policy
• Policy: Delete Policy
• Policy: Get List of Policies
• Policy: Update Policy
• Service Group: Create Service Group
• Service Group: Delete Service Group
• Service Group: Get Service Groups
• Service Group: Update Service Group
• Service: Create Service
• Service: Delete Service
• Service: Get Services
• Service: Update Service
• URL: Block URL
• URL: Get Blocked URLs
• URL: Unblock URL
• User: Create User
• User: Delete User
• User: Get User Last Login Details
• User: Update User
• Users: Get Users

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.

Blocking or Unblocking IP addresses, URLs, or applications on Fortinet FortiGate

1. Log on to the Fortinet FortiGate server with the necessary credentials.
2. To block or unblock an IP address, you must create a policy for IP addresses on the Fortinet FortiGate server. The following steps define the process of adding a policy:
   1. In Policy & Objects, click Addresses to create an address group with the following conditions:
      • Category = IPv4 Group
      • Group Name = Blocked_IPs
      • Type = Group
      • Member = none
   2. NOTE: You can create different address groups for source and destination.
      For more information on creating address groups and address group exclusions, see the FortiOS 7.2.3 Address Group Exclusion.
      NOTE: For IPv6 addresses, you can specify the Category as IPv6 Group.
   3. In Policy & Objects, click Firewall Policy to create a policy for IPv4 with the following conditions:
      • Name = FortiSOAR_Blocked_Policy
      • Source = Blocked_IPs
      • Destination = Blocked_IPs
      • Schedule = always
      • Service = ALL
      • Action = DENY
      • Enable this policy = Enable
   4. In Policy & Objects, click Firewall Policy and enter the firewall policy name as the Action parameter. For our example, we have named this as FortiSOAR_Blocked_Policy. When you are configuring your Fortinet FortiGate connector in FortiSOAR™, you must use the policy name that you have specified in this step as your Policy Name action parameter.
      For more information on the firewall policy, see Firewall Policy in the FortiOS documentation.

      NOTE: If your VDOM's NGFW Mode is Policy Based then click on Security Policy in Policy & Object to create policy.

3. To block or unblock a URL, you must create a profile for blocking or unblocking static URLs on the Fortinet FortiGate server. For information on creating web filters, see Web Filter in the FortiOS 7.2.3 Administration Guide.
4. The following steps define the process of adding a policy:
   1. In Security Profiles, click Web Filter to create a new profile for blocking or unblocking static URLs or use the default profile.
      NOTE: Ensure that the URL Filter is enabled.
   2. Enter the Web Filter Profile name on the configuration page. For our example, we have named this URL Block Policy. When you are configuring your Fortinet FortiGate connector in FortiSOAR™, you must use the Web Filter Profile name that you have specified in this step as your Web Filter Profile Name configuration parameter.
5. To block or unblock an application, you must create a profile for blocking or unblocking applications on the Fortinet FortiGate server. The following steps define the process of adding a policy:
   1. In Security Profiles, click Application Control to create a new profile for blocking or unblocking applications or use the default profile.
   2. Enter the policy name on the configuration page. For our example, we have named this App Block Policy. When you are configuring your Fortinet FortiGate connector in FortiSOAR™, you must use the Application Control Profile name that you have specified in this step as your Application Control Profile Name configuration parameter.
      For information on adding application controls, see Application Control FortiOS 7.2.3 Administration Guide.