Troubleshooting Tip: FortiOS Connector Playbook Shows Empty Fields in FortiAnalyzer Even with FortiGate showing Online

Description

This article describes how to resolve an issue where the FortiOS Connector playbook in FortiAnalyzer displays empty device and automation field, even though the connected FortiGate is showing as online and sending logs. The root cause in this scenario is a missing automation configuration for an incoming webhook call on the FortiGate

Scope

FortiGate, FortiAnalyzer.

Solution

The FortiAnalyzer status on the FortiGate shows as 'Up' and connected.

On the FortiAnalyzer, the FortiGate is displayed as registered and online.

However, when creating a playbook in FortiAnalyzer and selecting the FortiOS Connector, the device list appears empty.

Check whether an incoming webhook call is configured in the FortiGate's automation stitches with a status of enabled.

Once the incoming webhook automation stitch is configured on the FortiGate, the playbook in FortiAnalyzer will display devices when the FortiOS Connector is selected.

The FortiOS connector status can also be verified from Fabric View -> Automation -> Connectors, and ensure that the Incoming Webhook Call is displayed as 'Online'.

The device now appears when creating a playbook in FortiAnalyzer and selecting the FortiOS Connector.

Even under Automation, the option to select Incoming Webhook Call is now available.