Default automation stitches

The following default automation stitches are included in FortiOS:

Category	Name
Compromised Host	Access_Layer_Quarantine Compromised Host Quarantine
Configuration Change	Configuration_Change_Notification
FortiOS Event Log	Firmware Upgrade Cancelled Firmware Upgrade Failure Firmware Upgrade Scheduled Firmware Upgrade Success FortiAnalyzer Connection Down Network Down Super Admin Creation Notification
HA Failover	HA Failover
Incoming Webhook	Incoming Webhook Quarantine activate_strict_ips add_cnc_to_blacklist
License Expiry	License Expired Notification
Reboot	Reboot
Schedule	AWS_Activate_VM AWS_Deactivate_VM
Security Rating Summary	Security Rating Notification

To view and edit the automation stitches in the GUI, go to Security Fabric > Automation.

CLI configurations

Compromised Host Quarantine

config system automation-action
    edit "Access Layer Quarantine"
        set description "Quarantine the MAC address on access layer devices (FortiSwitch and FortiAP)."
        set action-type quarantine
    next
    edit "FortiClient Quarantine"
        set description "Use FortiClient EMS to quarantine the endpoint device."
        set action-type quarantine-forticlient
    next
end

config system automation-trigger
    edit "Compromised Host"
        set description "An incident of compromise has been detected on a host endpoint."
    next
end

config system automation-stitch
    edit "Compromised Host Quarantine"
        set description "Quarantine a compromised host on FortiAPs, FortiSwitches, and FortiClient EMS."
        set status disable
        set trigger "Compromised Host"
        config actions
            edit 1
                set action "Access Layer Quarantine"
            next
            edit 2
                set action "FortiClient Quarantine"
            next
        end
    next
end

Firmware Upgrade Cancelled

config system automation-action
    edit "Auto Upgrade Cancelled Email Notification"
        set description "Send auto upgrade cancelled email notification to the FortiCare email address registered on this device."
        set action-type email
        set forticare-email enable
        set email-subject "Firmware Update Cancelled Notification : %%log.devname%%"
        set message "Date: %%log.date%% Time: %%log.time%% 
An automated firmware update has been cancelled on device: %%log.devname%%, serial number %%log.devid%%.

This is an informational notification and was generated by automation stitch configuration on %%log.devname%%."
    next
end

config system automation-trigger
    edit "Auto Firmware Upgrade Cancelled"
        set description "Automatic firmware upgrade cancelled."
        set event-type event-log
        set logid 32325
    next
end

config system automation-stitch
    edit "Firmware Upgrade Cancelled"
        set description "Automatic firmware upgrade cancelled notification."
        set trigger "Auto Firmware Upgrade Cancelled"
        config actions
            edit 1
                set action "Auto Upgrade Cancelled Email Notification"
            next
        end
    next
end

Firmware Upgrade Failure

config system automation-action
    edit "Email Notification"
        set description "Send a custom email notification to the FortiCare email address registered on this device."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
    next
end

config system automation-trigger
    edit "Auto Firmware Upgrade Failure"
        set description "Automatic firmware upgrade failure."
        set event-type event-log
        set logid 22095 22097
    next
end

config system automation-stitch
    edit "Firmware Upgrade Failure"
        set description "Automatic firmware upgrade failure notification."
        set status disable
        set trigger "Auto Firmware Upgrade Failure"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Firmware Upgrade Scheduled

config system automation-action
    edit "Auto Upgrade Scheduled Email Notification"
        set description "Send scheduled auto upgrade email notification to the FortiCare email address registered on this device."
        set action-type email
        set forticare-email enable
        set email-subject "Firmware Update Scheduled Notification : %%log.devname%%"
        set message "Date: %%log.date%% Time: %%log.time%% 
An automated firmware update has been scheduled on device: %%log.devname%%, serial number %%log.devid%%.
%%log.msg%% 

This is an informational notification and was generated by automation stitch configuration on %%log.devname%%."
    next
end

config system automation-trigger
    edit "Auto Firmware Upgrade Scheduled"
        set description "Automatic firmware upgrade scheduled."
        set event-type event-log
        set logid 32263
    next
end

config system automation-stitch
    edit "Firmware Upgrade Scheduled"
        set description "Automatic firmware upgrade scheduled notification."
        set trigger "Auto Firmware Upgrade Scheduled"
        config actions
            edit 1
                set action "Auto Upgrade Scheduled Email Notification"
            next
        end
    next
end

Firmware Upgrade Success

config system automation-action
    edit "Auto Upgrade Success Email Notification"
        set description "Send auto upgrade success email notification to the FortiCare email address registered on this device."
        set action-type email
        set forticare-email enable
        set email-subject "Firmware Update Notification : %%log.devname%%"
        set message "An automated firmware update has completed successfully. The device %%log.devname%%, serial number %%log.devid%%, was updated to firmware version %%log.version%% on %%log.date%% %%log.time%%.

This is an informational notification and was generated by automation stitch configuration on %%log.devname%%."
    next
end

config system automation-trigger
    edit "Auto Firmware Upgrade Success"
        set description "Automatic firmware upgrade complete successfully."
        set event-type event-log
        set logid 22096 22094
    next
end

config system automation-stitch
    edit "Firmware Upgrade Success"
        set description "Automatic firmware upgrade success notification."
        set trigger "Auto Firmware Upgrade Success"
        config actions
            edit 1
                set action "Auto Upgrade Success Email Notification"
            next
        end
    next
end

FortiAnalyzer Connection Down

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "FortiAnalyzer Connection Down"
        set description "A FortiAnalyzer connection is down."
        set event-type event-log
        set logid 22902
    next
end

config system automation-stitch
    edit "FortiAnalyzer Connection Down"
        set description "Send an email notification when the connection to FortiAnalyzer is lost."
        set status disable
        set trigger "FortiAnalyzer Connection Down"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Network Down

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Network Down"
        set description "A network connection is down."
        set event-type event-log
        set logid 20099
        config fields
            edit 1
                set name "status"
                set value "DOWN"
            next
        end
    next
end

config system automation-stitch
    edit "Network Down"
        set description "Send an email when a network goes down."
        set status disable
        set trigger "Network Down"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

HA Failover

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "HA Failover"
        set description "A HA failover has occurred."
        set event-type ha-failover
    next
end

config system automation-stitch
    edit "HA Failover"
        set description "Send an email when a HA failover is detected."
        set status disable
        set trigger "HA Failover"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Incoming Webhook Quarantine

config system automation-action
    edit "Access Layer Quarantine"
        set description "Quarantine the MAC address on access layer devices (FortiSwitch and FortiAP)."
        set action-type quarantine
    next
    edit "FortiClient Quarantine"
        set description "Use FortiClient EMS to quarantine the endpoint device."
        set action-type quarantine-forticlient
    next
end

config system automation-trigger
    edit "Incoming Webhook Call"
        set description "An incoming webhook call is received"
        set event-type incoming-webhook
    next
end

config system automation-stitch
    edit "Incoming Webhook Quarantine"
        set description "Quarantine a provided MAC address on FortiAPs, FortiSwitches, and FortiClient EMS using an Incoming Webhook."
        set status disable
        set trigger "Incoming Webhook Call"
        config actions
            edit 1
                set action "Access Layer Quarantine"
            next
            edit 2
                set action "FortiClient Quarantine"
            next
        end
    next 
end

License Expired Notification

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "License Expiry"
        set description "A FortiGate license is near expiration."
        set event-type license-near-expiry
        set license-type any
    next
end

config system automation-stitch
    edit "License Expired Notification"
        set description "Send an email notification when a license is near expiration."
        set status disable
        set trigger "License Expiry"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next

Reboot

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Reboot"
        set description "A FortiGate is rebooted."
        set event-type reboot
    next
end

config system automation-stitch
    edit "Reboot"
        set description "Send an email when a FortiGate is rebooted."
        set status disable
        set trigger "Reboot"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end

Security Rating Notification

config system automation-action   
    edit "Email Notification"
        set description "Send a custom email to the specified recipient(s)."
        set action-type email
        set forticare-email enable
        set email-subject "%%log.logdesc%%"
        set message "%%log%%"
    next   
end

config system automation-trigger
    edit "Any Security Rating Notification"
        set description "A security rating summary report has been generated."
        set event-type security-rating-summary
        set report-type any
    next 
end

config system automation-stitch
    edit "Security Rating Notification"
        set description "Send an email notification when a new Security Rating report is available."
        set status disable
        set trigger "Any Security Rating Notification"
        config actions
            edit 1
                set action "Email Notification"
            next
        end
    next
end