In this recipe, you configure Automations for your Fortinet Security Fabric. Each Automation pairs an event trigger and one or more actions, which allows you to monitor your network and take appropriate action when the Security Fabric detects a threat. You can use Automations to detect events from any source in the Security Fabric and apply actions to any destination.
This recipe is in the Security Fabric Collection. You can also use it as a standalone recipe.
In this example, you create the following Automations:
- Ban a compromised host’s IP address.
- Send an email alert when HA failover occurs.
In this example, the Security Fabric consists of Edge, an HA cluster that is the root FortiGate of the Security Fabric, and three ISFW FortiGate devices (Accounting, Marketing, and Sales). You configure the Automations on the root FortiGate and the settings are synchronized with the other FortiGate devices in the Security Fabric.
1. Creating the Automations
|
|
To create a new Automation that bans the IP address of a compromised host, go to Security Fabric > Automation.
Set FortiGate to All FortiGates.
Set Trigger to Compromised Host. Set IOC level threshold to High.
Set Action to IP Ban.
|
![]( "1a-compromise-block-ip") |
|
Create a second Automation that sends an email alert when HA failover occurs.
Set FortiGate to Edge-Primary, which is part of the only HA cluster in the Security Fabric.
Set Trigger to HA Failover. Set Action to Email.
Set the Email subject and email address to send alerts to.
|
![]( "1b-HA-failover") |
2. Testing the Automations
|
|
Instead of testing the Automation that blocks compromised hosts, the following steps simulate its effects by manually blocking the IP address of a PC on your network.
Go to Security Fabric > Physical Topology and locate a PC on your network. Right-click the PC and select Ban IP.
|
![]( "2a-topology") |
|
Set Ban Type to Temporary. Set Duration to 30 minutes.
|
![]( "2b-IP-ban") |
|
To test the Automation for HA failover, go to Edge-Primary. In the administrative drop-down menu, select System > Reboot.
Set an Event log message.
|
![]( "2c-reboot") |
3. Results
|
|
The banned device can no longer access the Internet.
|
|
When HA failover occurs, an email similar to the one shown is sent to the email that you configured in the Automation.
|
![]( "3b-failover-email") |
For further reading, check out Using the Security Fabric to improve network security in the FortiOS 6.0 Online Help.
If you select the Medium threshold, the event trigger occurs for both medium and high level IOC threats.
The post Automations for the Security Fabric appeared first on Fortinet Cookbook.
