Security Fabric connectors

You can use the Active Connectors tab to create and edit the following types of security fabric connectors:

• FortiClient EMS
• FortiMail
• FortiCASB
• FortiAuthenticator
• FortiWeb
• FortiSandBox

Once configured, Security Fabric connectors enrich incident response related actions available in playbooks.

To create a Security Fabric connector:

1. Go to Incidents & Events > Automation > Active Connectors, and click Create New.

   The Create New Fabric Connector pane displays.

2. Under Security Fabric, select one of the available connector types.

3. In the Configuration tab, configure the following options for:

   FortiClient EMS

   Property		Description
   Type		Select FortiClient EMS or FortiClient EMS Cloud.
   Name		Type a name for the Security Fabric connector.
   Description		(Optional) Type a description for the Security Fabric connector.
   FortiClient EMS	IP/FQDN	Type the IP address or FQDN for the Security Fabric device.
   	Username	Type the username for the Security Fabric device.
   	Password	Type the password for the Security Fabric device.
   FortiClient EMS Cloud	Account ID	Super users can type the account ID of the FortiClient EMS Cloud instance. For non-super users, the field is automatically populated with the default account ID. The FortiAnalyzer device must be registered with FortiCloud to create and update the connector as a non-super user. The FortiClient EMS must be v7.0 or later. After the FortiClient EMS Cloud connector is created, the connector's health-check sends an authentication request with SNI (the account ID) to the EMS instance. The authentication request from the FortiAnalyzer device must be approved in EMS: Administration > Fabric Devices. For more information, see FortiClient on the Fortinet Document Library.

   FortiMail

   Property	Description
   Name	Type a name for the Security Fabric connector.
   Description	(Optional) Type a description for the Security Fabric connector.
   IP/FQDN	Type the IP address or FQDN for the Security Fabric device.
   Username	Type the username for the Security Fabric device.
   Password	Type the password for the Security Fabric device.

   FortiCASB

   Property	Description
   Name	Type a name for the Security Fabric connector.
   Description	(Optional) Type a description for the Security Fabric connector.
   IP/FQDN	Type the IP address or FQDN for the Security Fabric device. Use the FortiCASB FQDN for your chosen server location. The server location is selected when creating your FortiCASB account. Use forticasb.com for global servers or eu.forticasb.com for EU based servers.
   Account ID	Enter the credentials token used for authentication. To create a FortiCASB credentials token, log in to FortiCASB with your account, go to Home > Manage Company > API Setting, and click Generate New. For more information, see FortiCASB on the Fortinet Docs Library.

   FortiAuthenticator

   Property	Description
   Name	Type a name for the Security Fabric connector.
   Description	(Optional) Type a description for the Security Fabric connector.
   IP/FQDN	Type the IP address or FQDN for the Security Fabric device.
   User Name	Type the username for the Security Fabric device.
   API Key	Enter the API key for the FortiAuthenticator device.

   FortiWeb

   Property	Description
   Name	Type a name for the Security Fabric connector.
   Description	(Optional) Type a description for the Security Fabric connector.
   IP/FQDN	Type the IP address or FQDN for the Security Fabric device.
   User Name	Type the username for the Security Fabric device.
   Password	Type the password for the Security Fabric device.
   FortiWeb ADOM	Enter the FortiWeb ADOM that the device is in.

   FortiSandBox

   Property	Description
   Name	Type a name for the Security Fabric connector.
   Description	(Optional) Type a description for the Security Fabric connector.
   IP/FQDN	Type the IP address or FQDN for the Security Fabric device.
   User Name	Type the username for the Security Fabric device.
   Password	Type the password for the Security Fabric device.
   FortiSandBox Version	Enter the version of the FortiSandBox device.
   FortiSandBox Instance Type	Select the FortiSandBox instance type: On Premise or Cloud.

4. Click the Actions tab to view the actions available with the Security Fabric connector, then click OK.

   After the connector is saved, it is visible in Incidents & Events > Automation > Active Connectors with a toggle to enable or disable the connector.

5. Toggle the status of the connector to disabled or enabled according to your needs.

After the Security Fabric connector is created, playbooks configured in Fabric View can use the connector to execute automated actions. For a list of connector actions available in playbooks, see Configuring connectors for automation.

Default playbooks are automatically created when configuring some Security Fabric connectors. For more information on playbooks, see Playbooks.

To edit a Security Fabric connector:

1. Go to Incidents & Events > Automation > Active Connectors.

2. Select a Security Fabric connector, and click Edit.

   The Edit Connectors pane displays.

3. Edit the settings, and click OK.