Creating a trigger
Define the events to trigger the system to take actions. You can define the "FortiWeb Log" trigger event or use the pre-defined triggers including low memory, HA failover, reboot, etc.
FortiWeb supports the following triggers.
|
Trigger |
Description |
|---|---|
| System triggers | |
| Reboot | The "Reboot" trigger detects whether the system reboots. |
| Low memory | The "Low memory" trigger detects whether FortiWeb's available memory is less than the value specified in Log&Report > Log Config > Other Log Settings > Memory Utilization. |
| HA |
The "HA" trigger detects whether the following HA events occur:
|
|
High CPU |
The "High CPU" trigger detects whether the CPU usage of FortiWeb is higher than the value specified in Log&Report > Log Config > Other Log Settings > CPU Utilization. Refer to Use case: Real-time incident alerts for an example of the High CPU use case. |
|
Local Certificate Expired |
The Local Certificate is used to encrypt the HTTPS connections between:
If the certificate expires, users will see a certificate invalid warning. To avoid such warning messages displayed to users, you can use a "Local Certificate Expired" trigger to detect whether the certificates you have uploaded on the following pages are about to expire then update them in time:
FortiWeb by default doesn't log the SSL certificate expire event. Therefore, to use this trigger, you need to run the following command to set the notification time (the days) to a value other than 0 (0 means disabled), so FortiWeb will send notification on the specified day before the certificate expires. config system global set cert-expire-check-time <integer> end Refer to Use case: Expired SSL certificate management for an example of the use case. |
|
License Expired |
The "License Expired" trigger detects whether the FortiWeb license expires. Please note that if the network of FortiWeb is disconnected over 48 hours, it will also trigger the "License Expired" event. Refer to Example: Notification Message for the "License Expired" trigger for the suggested message to be sent when "License Expired" trigger occurs. |
|
FDS DB updates |
This trigger detects whether FortiGuard Database (FDS DB) Update occurs. The FortiGuard Database provides up-to-date threat intelligence. When an FDS DB update occurs, go to the Signature Update Management tab on System > Config > FortiGuard. The newly added or updated signatures are listed there and are set to alert mode by default. Test the signatures first to ensure they don't trigger false positives or block legitimate traffic. Once deemed safe, select the signature and click Approve. Refer toUse case: Automated response to FortiGuard Database (FDS DB) updates for an example of the use case. |
| Miscellaneous triggers | |
| FortiWeb Log |
Use this trigger to initiate the automation action when system prints certain even logs or attack logs. Refer to the following use cases. |
|
Schedule |
Use this trigger to schedule FortiWeb to take certain actions regularly. For example, run |
All the System triggers are pre-defined. You can only enter a name and description for them. The configuration is straightforward so we will not elaborate on it.
Advanced Settings
The Advanced Settings section provides additional configuration options to fine-tune the behavior and execution parameters of automation triggers. This section allows for more granular control over how and when trigger conditions are evaluated, ensuring that automation workflows align with specific operational requirements and organizational policies.
Rolling Window
The Rolling Window configuration enables frequency-based control for specific automation triggers. Instead of an action firing every time a single event is detected, the trigger only activates if a specific number of occurrences are recorded within a defined time interval. This mechanism is essential for mitigating "alert flooding" in scenarios such as sustained attacks or high-frequency log generations.
To configure these frequency controls, enable Advanced Settings within the trigger configuration page for the following supported trigger types:
-
Low memory
-
HA (HA failover)
-
High CPU
-
Local Certificate Expired
-
FDS DB updates
-
FortiWeb Log
|
Setting |
Description |
|---|---|
| Rolling Window | Enables or disables the frequency-based threshold mechanism for the selected trigger. When disabled, the automation fires immediately every time the trigger condition is met. This is disabled by default. |
| Rolling Window Time | Specifies the time interval, in seconds, during which FortiWeb monitors and counts trigger events. If the timer expires before the occurrence threshold is reached, the system resets the count and timer to zero. The valid range is 1 to 3,600 seconds, the default is 300 seconds. |
| Number of Occurrences | Sets the specific number of times a trigger condition must be met within the Rolling Window Time before the action is initiated. Once this threshold is reached, the action triggers, and both the counter and timer reset. The valid range is 1 to 3,600, the default is 300 seconds. |
Note: Every automation trigger maintains its own independent timer and occurrence counter.
For high-volume attack logs, you might set a Rolling Window Time of 600 seconds with 600 Occurrences. This ensures your automation stitch (such as an email alert or CLI script) only activates when a threat reaches a significant, sustained frequency, effectively filtering out noise from isolated incidents.
In the following sections, we will introduce how to create the two triggers that have more complicated settings:
When the trigger occurs, it's important to provide sufficient information in the notification sent to your security or IT team so that they can take appropriate actions. We have provided some example of the messages for your reference: Notification message examples.