Explorer II

Question

Automate Address List with FortiAnalizer/Playbooks/Fortigate

Forum|Forum|2 years ago
August 9, 2024
3 replies
1455 views

Hi People I need to create an automation to save all the malicious addresses that the FortiAnalizer collects/analyzes and automatically save them in a group of addresses for me to block them from the firewall. I want to know if Fortigate and FortiAnalizer can do something like this. I have the FortiSOC version available if it is necessary to do it with Playbooks. The truth is that I did not find anything like that.

Staff

Hello @Lucas1 ,

Please review https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-SSL-VPN-failed-logins-with-an-automation/ta-p/287171. According to this document, you can see a functionality where an automation stich can add IP addresses into a group.

Thanks,
Ronak Patel

Staff

Hello @Lucas1

You can also use threat feed to block the malicious address list.

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/891236/ip-address-threat-feed

Staff

Hello @Lucas1

You can create an event handler on FortiAnalyzer to block such failed attempt IPs.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enhance-SSL-VPN-Security-by-blocking-offenders-IP/ta-p/314443

salmas

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.

Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.

Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT