You can create a Security Fabric connector on FortiAnalyzer for FortiClient EMS, FortiMail, and FortiCASB. Once configured, Security Fabric connectors enrich incident response related actions available in FortiSoC.
- Go to Fabric View > Fabric > Connectors, and click Create New.
- Under Security Fabric, click FortiClient EMS, FortiMail, or FortiCASB. The Create New Fabric Connector dialog opens.
- In the Configuration tab, configure the connector settings, and click OK.
Name Type a name for the Security Fabric connector. Description (Optional) Type a description for the Security Fabric connector. IP\FQDN
Type the IP address or FQDN for the Security Fabric device.
For FortiCASB connectors, use the FortiCASB FQDN for your chosen server location. The server location is selected when creating your FortiCASB account. Use
forticasb.comfor global servers or
eu.forticasb.comfor EU based servers.
Type the username for the Security Fabric device. The Username field is only displayed for FortiClient EMS and FortiMail connectors.
Type the password for the Security Fabric device. The Password field is only displayed for FortiClient EMS and FortiMail connectors.
Enter the credentials token used for authentication. The Token field is only displayed for FortiCASB connectors.
To create a FortiCASB credentials token, log in to FortiCASB with your account, go to Home > Manage Company > API Setting, and click Generate New. For more information, see FortiCASB on the Fortinet Docs Library.
Status Toggle On to enable the Security Fabric connector. Toggle Off to disable the Security Fabric connector.
- Click the Actions tab to view the actions available with the Security Fabric connector, then click OK.
After the Security Fabric connector is created, playbooks configured in FortiSoC can use the connector to execute automated actions. For a list of connector actions available in FortiSoC playbooks, see Connectors.
Default playbooks are automatically created when configuring some Security Fabric connectors. For more information on playbooks in FortiSoC, see Playbooks.
- Go to Fabric View > Fabric > Connectors.
- Right-click a Security Fabric connector, and select Edit.
The Edit Connectors dialog box is displayed.
- Edit the settings, and click OK.