FortiOS 6.0 Getting Started: Automation stitches

In this recipe, you configure Automation stitches for your Fortinet Security Fabric. Each Automation pairs an event trigger and one or more actions, which allows you to monitor your network and take appropriate action when the Security Fabric detects a threat. You can use Automation stitches to detect events from any source in the Security Fabric and apply actions to any destination.

In this example, you create the following Automation stitches:

1). Ban a compromised host’s IP address.
2). Send an email alert when HA failover occurs.

In this example, the Security Fabric consists of Edge, an HA cluster that is the root FortiGate of the Security Fabric, and three ISFW FortiGate devices (Accounting, Marketing, and Sales). You configure the Automation stitches on the root FortiGate and the settings are synchronized with the other FortiGate devices in the Security Fabric.

1. Creating the Automation stitches

To create a new Automation that bans the IP address of a compromised host, go to Security Fabric > Automation.

Set FortiGate to All FortiGates.

Set Trigger to Compromised Host. Set IOC level threshold to High.*

Set Action to IP Ban.

Create a second Automation that sends an email alert when HA failover occurs.

Set FortiGate to Edge-Primary, which is part of the only HA cluster in the Security Fabric.

Set Trigger to HA Failover. Set Action to Email.

Set the Email subject and email address to send alerts to.

2. Testing the Automation stitches

If your FortiOS version is 6.0.2 or higher, to test the Automation stitches go to Security Fabric > Automation, right-click the Automation, and select Test Automation Stitch.

If your FortiOS version is 6.0.0 or 6.0.1, use the following instructions to test the automation stitches.

Instead of testing the Automation that blocks compromised hosts, the following steps simulate its effects by manually blocking the IP address of a PC on your network.

Go to Security Fabric > Physical Topology and locate a PC on your network. Right-click the PC and select Ban IP.

Set Ban Type to Temporary. Set Duration to 30 minutes.

To test the Automation for HA failover, go to Edge-Primary. In the administrative drop-down menu, select System > Reboot.

Set an Event log message.

3. Results 

If you have simulated the the Automation that blocks compromised hosts, the banned device can no longer access the Internet.

When HA failover occurs or when the Automation is tested, an email similar to the one shown is sent to the email that you configured in the Automation.