Skip to main content
DanieleS99
DanieleS99
Explorer
February 4, 2022
Solved

Alert when ip goes in quarantine

  • February 4, 2022
  • 2 replies
  • 2764 views

Hi,

I'm trying to figure out how to send an alert when an ip address is quarantined by the dos policy...
Does anyone know how to do this through automation stitches?

 

Thanks

Best answer by Debbie_FTNT

Hey Daniele,

there should be event logs like

22850 - LOG_ID_USER_QUARANTINE_MAC_ADD

or
43776 - LOG_ID_EVENT_NAC_QUARANTINE

-> check your system event logs on FortiGate

 

You can create an automation stitch to trigger on the event log message; this is triggered based on the log ID. The last five numbers of the log ID are the specific log message ID that an automation stitch will trigger on.

2 replies

Debbie_FTNT
Staff & Editor
Debbie_FTNTAnswer
Staff & Editor
February 4, 2022

Hey Daniele,

there should be event logs like

22850 - LOG_ID_USER_QUARANTINE_MAC_ADD

or
43776 - LOG_ID_EVENT_NAC_QUARANTINE

-> check your system event logs on FortiGate

 

You can create an automation stitch to trigger on the event log message; this is triggered based on the log ID. The last five numbers of the log ID are the specific log message ID that an automation stitch will trigger on.

    DanieleS99
    DanieleS99Author
    Explorer
    February 4, 2022

    Thanks, it works.

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!