Technical Tip: Updating a FortiManager local external resource feed from a FortiAnalyzer playbook

Description

This article describes how to use a FortiAnalyzer playbook, triggered by an event handler, to update a FortiManager local external resource feed.

Scope

FortiAnalyzer v7.6, v8.0, FortiManager, FortiGate.

Solution

This example uses an administrator who fails to log in to a FortiGate. The login generates a system event log with the following Log ID: 0100032002.

The workflow is:

• An administrator logs in to the FortiGate.

• The FortiGate sends the log to FortiAnalyzer.

• A FortiAnalyzer Alert/Event Handler detects the event.

• The Alert/Event Handler triggers a playbook.

• The playbook creates an incident.

• The playbook retrieves the current external resource feed from FortiManager.

• The playbook checks whether the source IP is already present.

• If the source IP is not present, the playbook appends it and updates the feed.

• If the source IP is already present, the feed is not modified, and the incident is updated accordingly.

Note: A FortiManager API set request replaces the complete content of the external resource file. It does not automatically append a new entry. Therefore, the playbook must first retrieve the current content and include it in the subsequent set request.

Download pre-built Playbooks from the GitHub repository Update IP Feed on FortiManager.

Topology:

1. Create a FortiManager API Administrator.

Create an API Admin user in FortiManager, refer to Creating administrators for the FortiManager API, set JSON API Access to 'Read-Write', and set the FortiAnalyzer IP address as a trusted host. Keep the API safe, as it will be used later.

2. Create the External Resource Feed.

In FortiManager, navigate to FortiGuard -> External Resources -> Files -> Create/Import an external resource file named: test_feed.txt.

The external resource feed can be referenced by a FortiGate firewall policy or security profile as required.

3. Create the FortiManager API Connector in FortiAnalyzer.

Under FortiAnalyzer -> Incidents & Alerts (old versions: Incidents & Events) -> Automation -> Active Connectors -> Create new -> Select 'Generic Connector':

Configure these HTTP headers:

4. Create the FortiAnalyzer Alert (Event) Handler.

Under FortiAnalyzer -> Incidents & Alerts -> Alert Handler (Event Handler) -> Create New:

Under Rules, select Add New Rule and configure:

Under Log Filters, configure:

Set the alert to trigger when a group contains one or more log occurrences within one minute. Save the rule and the handler.

5. Create a FortiAnalyzer playbook.

Under FortiAnalyzer -> Incidents & Alerts -> Automation -> Playbook -> Create New -> Select New Playbook created from scratch. Name the playbook: Update_IP_Feed_on_FMG. Enable the playbook after all tasks have been configured.

Playbook workflow:

Playbook Step 1: Alert Trigger.

• Choose Trigger: Alert Trigger.

• Add condition -> 'Basic Handler Name' Equal To 'FortiGate_Login'. Select Save.
  
  

Playbook Step 2: Retrieve the current feed content.

• Select the '+' icon to the right of the ALERT_TRIGGER step to add a new step.

• Select Webhook -> FortiManager_API -> POST Request.

  • Name: Get_Current_Feed_Content

  • HTTP Body -> Select the 'A' icon to switch to text mode and set the following API call (the 'test_feed.txt' is the name of the External Resource list created in FortiManager), then select SAVE.
    
    

{
  "id": 1,
  "method": "get",
  "params": [
    {
      "url": "pm/config/global/_external/resource/test_feed.txt"
    }
  ],
  "verbose": 1
}

Playbook Step 3: Update feed on FortiManager.

• Select the '+' icon to the right of the POST Request (Get_Current_Feed_Content) step to add a new step.

• Select Webhook -> FortiManager_API -> POST Request.

  • Name: Update_IP_Feed_on_FMG.

  • HTTP Body: Select the 'A' icon to switch to text mode and set the following API call:
    
    

{
  "id": 2,
  "method": "set",
  "params": [
    {
      "data": {
        "content": "${get_current_feed_content.response.result[0].data.content}
${trigger.groupby1}"
      },
      "url": "pm/config/global/_external/resource/test_feed.txt"
    }
  ]
}

Here, get_current_feed_content.response is the Task ID of the Get_Current_Feed_Content step and ${get_current_feed_content.response.result[0].data.content} refers to the 'content' field - in the API response of 'Get_Current_Feed_Content', which fetches the current list of IP addresses present in the Feed.

The trigger is the Task ID of the first Trigger step of the playbook and {trigger.group1} refers to the Log Field option of the Alert Rule, which was set to 'Source IP'.

Note:

FortiAnalyzer v7.6 may not allow the visible task name to be used directly as the task ID, except for the initial trigger task. Refer to the Configuring tasks using variables section 'Obtaining task IDs'.

For example, to obtain the task ID of the 'Get_Current_Content' step:

• In the 'Update_IP_Feed_on_FMG' step in the 'body' field drop down select 'Get_Current_Content', and the next drop down will automatically populate with 'response'.

• Select the 'A' icon to switch to text mode. It will show the task ID like: placeholder_15f3b0d8_b6fb_4e99_9a4a_0928141f1f5d.response.

• Use that in the API call above.

Playbook Step 4: Check whether the IP already exists.

Check if the IP address is already present in the IP Feed in FortiManager. Use the Switch Operator for comparison.

Between the two Post Requests, Get_Current_Feed_Content and Update_IP_Feed_on_FMG select the '+' icon -> LocalHost -> Select Switch Operator:

• Name: Check_if_IP_already_exist.

• Under 'Condition', set the following Jinja script, which returns TRUE if the source IP from the alert is not already present:

{%- set feed = get_current_feed_content.response.result[0].data.content | default('') -%}
{%- set ip = trigger.groupby1 | string | trim -%}
{{- ip not in feed.splitlines() -}}

• Next Task: Update_Feed_on_FMG.

• Label: IP Check.

• Select Save.
  
  

Note:

The FortiAnalyzer v7.6 does not have the 'Switch Operator' action; instead, use the 'Branch Operator' action:

To obtain the task IDs, refer to the document Configuring tasks using variables.

Playbook Step 5: Create Incident.

• Under the ALERT_TRIGGER step, add a new step by dragging the arrow.

• Select LocalHost -> Create Incident:
  
  

• Connect the Create_Incident step with the Switch_Operator step.

Playbook Step 6: Update incident - IP already exists.

Below the Switch_Operator (Branch Operator) step, add a new step by dragging the arrow -> Select LocalHost -> Update Incident:

• Edit the Switch_Operator step again and set Fallback: IP_Already_Exist.

Playbook Step 7: Update Incident - IP added to list.

Under the Update_IP_Feed_on_FMG step, add a new step by dragging the arrow -> Select LocalHost -> Update Incident:

• Name the Playbook: Update_IP_Feed_on_FortiManager, toggle the Enabled button, and select OK to save the playbook.

6. Verification:

To trigger the playbook, attempt a failed login to the FortiGate.

• Check the Playbook status: Incidents & Alerts -> Automation -> Playbook Monitor.

• Check the incident: Incidents & Alerts -> Incidents.

• Check the External Resource list on FortiManager -> FortiGuard -> External Resource -> Files to verify the list has been updated with the new IP address.
  
  

Related documents:

Playbooks

Alert Handlers

Active Connectors

Configuring playbook tasks