Fortinet black logo

Handbook

Execute multiple automation actions based on security events

Execute multiple automation actions based on security events

Automation stitches can be created to send out notifications when a security event occurs, such as from a WAP or DDoS attack.

In this example, three automation stitches are created that will send an Email, Syslog, and an SNMP Trap to notify the SOC team in the event of a DDoS attack.

To create the automation stitch and define the event trigger:

  1. Go to Security Fabric > Automation.
  2. Select Create New.
  3. Enter a name for the stitch.
  4. Select Enable to enable this automation.
  5. Select the trigger Security Events.
  6. Select the security events that will trigger the actions.
  7. Select the actions to automate.

    Security events trigger selection with Email, Syslog, and SNMP trap actions

  8. Configure each automation action.
  9. Select Save.
To configure the Email action:

Enter the following settings.

Name The action name.
To The email address of the recipient of this notification.
Email Subject The email subject line.
Email Body The email body.

To configure the Syslog action:

Enter the following settings.

Name The action name.
Delay

The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).

Address The IP address that will receive this message.
Port

The port that will receive this message. Range is 1 - 65535.

To configure the SNMP Trap action:

Enter the following settings.

Name The action name.
Delay

The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).

Hosts The IP address that will receive this message.
Version

The SNMP version to use: v1, v2c, or v3.

Local Port The source port number (0 - 65535, default = 162).
Remote Port The destination port number (0 - 65535, default = 162).

Security Level

The SNMP security level to use: Auth But no Privacy, Auth And Privacy, or No Privacy.

Available only if v3 is selected for Version.

Auth Algorithm

The authentication algorithm to use.

Available only if Auth But no Privacy or Auth And Privacy is selected for Security Level.

Auth Password

The password to the authentication algorithm.

Available only if Auth But no Privacy or Auth And Privacy is selected for Security Level.

Private Algorithm

The private algorithm to use.

Available only if Auth And Privacy is selected for Security Level.

Private Password

The password to the private algorithm.

Available only if Auth And Privacy is selected for Security Level.

Execute multiple automation actions based on security events

Automation stitches can be created to send out notifications when a security event occurs, such as from a WAP or DDoS attack.

In this example, three automation stitches are created that will send an Email, Syslog, and an SNMP Trap to notify the SOC team in the event of a DDoS attack.

To create the automation stitch and define the event trigger:

  1. Go to Security Fabric > Automation.
  2. Select Create New.
  3. Enter a name for the stitch.
  4. Select Enable to enable this automation.
  5. Select the trigger Security Events.
  6. Select the security events that will trigger the actions.
  7. Select the actions to automate.

    Security events trigger selection with Email, Syslog, and SNMP trap actions

  8. Configure each automation action.
  9. Select Save.
To configure the Email action:

Enter the following settings.

Name The action name.
To The email address of the recipient of this notification.
Email Subject The email subject line.
Email Body The email body.

To configure the Syslog action:

Enter the following settings.

Name The action name.
Delay

The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).

Address The IP address that will receive this message.
Port

The port that will receive this message. Range is 1 - 65535.

To configure the SNMP Trap action:

Enter the following settings.

Name The action name.
Delay

The amount of time after the previous action before this action executes, in seconds (0 - 3600, default = 0).

Hosts The IP address that will receive this message.
Version

The SNMP version to use: v1, v2c, or v3.

Local Port The source port number (0 - 65535, default = 162).
Remote Port The destination port number (0 - 65535, default = 162).

Security Level

The SNMP security level to use: Auth But no Privacy, Auth And Privacy, or No Privacy.

Available only if v3 is selected for Version.

Auth Algorithm

The authentication algorithm to use.

Available only if Auth But no Privacy or Auth And Privacy is selected for Security Level.

Auth Password

The password to the authentication algorithm.

Available only if Auth But no Privacy or Auth And Privacy is selected for Security Level.

Private Algorithm

The private algorithm to use.

Available only if Auth And Privacy is selected for Security Level.

Private Password

The password to the private algorithm.

Available only if Auth And Privacy is selected for Security Level.