FortiNAC quarantine setup example

FortiNDR supports FortiNAC quarantine by calling FortiNAC rest API to enable and disable the Host record that matches the supplied IP address.

For information about configure FortiNAC, see the FortiNAC Administration Guide in the Document Library.

To setup FortiNAC quarantine on FortiNDR:

1. In FortiNAC:
   1. Go to Users & Hosts > Administrators > Modify User.
   2. Enable REST API access to FortiNAC and generate HTTP API access token.
   3. Click OK.

   

2. Create new automation profile with action type: FortiNAC Quarantine.

   

3. When response action has been triggered, the detected IP that needs to be quarantined will be sent to FortiNAC via FortiNAC’s REST API call.