Technical Tip: Automation stitch to monitor specific administrator login & logout events and configuration changes

Create an automation stitch trigger with an additional user field filter. 

GUI -> Security Fabric -> Automation -> Trigger -> Create New -> FortiOS Event Log.

CLI:

config system automation-trigger
    edit "Admin_Monitor"
        set event-type event-log
        set logid 32001 32003 32102 44547
            config fields
                edit 1
                    set name "user"
                    set value "AdminUsername"      <------------ Replace with the admin username to monitor.
                next
            end
    next
end

Create an automation stitch action.

GUI -> Security Fabric -> Automation -> Action -> Create New -> Email.

CLI:

config system automation-action
    edit "Admin_Notify"
        set action-type email
        set email-to "mycorporate@mytestdomain.com"
        set email-subject "Admin Notification"
    next
end

Create the automation stitch.

GUI -> Security Fabric -> Automation -> Stitch -> Create New.

CLI:

config system automation-stitch
    edit "Admin_Notify"
        set trigger "Admin_Monitor"
            config actions
                edit 1
                    set action "Admin_Notify"
                    set required enable
                next
            end
    next
end