Technical Tip: How to create custom Event Handler in FortiAnalyzer for adding and modifying an open policy in FortiGate

Description

This article describes how to set up a FortiAnalyzer event handler to trigger events for specific configuration changes, such as adding or modifying firewall policies with certain conditions (open policy using 'all', 'any'). It provides a step-by-step guide on creating a custom filter to meet these requirements.

Scope

FortiAnalyzer, FortiGate.

Solution

To configure the FortiAnalyzer event handler for custom notification requirements, follow these steps:

1. Go to Incidents & Events -> Event Handler -> Create New.

2. In the Event Handler window, select:

• Log Device Type: 'Fortigate'.

• Log Type: Event Log (event).

• Log Subtype: System (system).

• Log Field: Message (msg).

Remove the default filter: Level (pri) - Equal To - Emergency.

3. In the Log Filter by Text field, enter the following custom filter to trigger events for adding new firewall policies with certain conditions: 

logid=0100044547 AND cfgpath="firewall.policy" AND action="Add" AND 
(cfgattr~"srcaddr\[all" OR cfgattr~"srcintf\[any" OR cfgattr~"dstaddr\[all" OR cfgattr~"dstintf\[any" OR cfgattr~"service\[ALL")

4. To trigger events for modifying existing firewall policies with certain conditions, use the following custom filter: 

logid=0100044547 AND cfgpath="firewall.policy" AND action="Edit" AND 
(cfgattr~"(srcaddr)\[.*?(->all\])" OR cfgattr~"(srcintf)\[.*?(->any\])" OR cfgattr~"(dstaddr)\[.*?(->all\])" OR cfgattr~"(dstintf)\[.*?(->any\])" OR cfgattr~"(service)\[.*?(->ALL\])") 

5. Once the logs are received by the FortiAnalyzer, an event will be created that can be checked on the Event Monitor page. 

6. Configure the notification settings as desired, such as sending emails or alerts to specific users or groups.

Troubleshooting: If the custom Event Handler does not trigger as expected after configuration:

• Verify that the Event Handler is enabled.

• Confirm that the expected logs are being received and are visible in Log View.

• Ensure that the configured filters (for example, logid, cfgpath, action, or other matching criteria) correspond to the actual log values

• Verify that the Event Handler is associated with the correct device(s) or ADOM.

• If notifications are configured, confirm that the notification destination is functioning correctly.

For deeper troubleshooting, refer to Troubleshooting Tip: How to troubleshoot for event handler related issues.

Related articles:

• Technical Tip: How to configure email alerts for configuration changes on FortiGate using FortiAnalyzer event handler

• Technical Tip: How to create Event handler in FortiAnalyzer for Policy delete in FortiGate

• Troubleshooting Tip: How to troubleshoot for event handler related issues