Configure automation-stitch to detect user trying to log to FortiGate GUI

Hi @Iamyourjoy33 

To configure an automation stitch for different conditions based on failed login attempts, you can follow these steps:

1. Define Event Handlers: Create two separate event handlers in FortiAnalyzer for each condition.

   • For User A, set the condition to trigger when there are more than 3 failed login attempts within a specific time frame.
   • For User B, set the condition to trigger on any failed login attempt, regardless of the count.

2. Configure Automation Stitch:

   • Create an automation stitch for each event handler.
   • For User A's stitch, configure the action to label it as a brute force attack.
   • For User B's stitch, configure the action to label it as a non-brute force alert.

3. Set Up Actions:

   • Define the actions for each stitch, such as sending an alert to your platform.
   • Use CLI scripts or other available actions to execute the desired response.

4. Test the Configuration:

   • Simulate failed login attempts for both User A and User B to ensure the automation stitches trigger correctly and send the appropriate alerts.

5. Monitor and Adjust:

   • Monitor the system to ensure the automation stitches are functioning as expected.
   • Adjust the conditions or actions if necessary to better fit your security requirements.

By setting up separate event handlers and automation stitches for each user condition, you can effectively manage and respond to different types of login attempts.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Automation-Stitch-using-Event-Handlers-from/ta-p/393536

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-an-automation-stitch-to-get-an-email/ta-p/285814

Best regards,

Erlin

If you are using just Fortigate - you cannot achieve such functionality, as automation stitches have no "memory", they can fire but each failed login will be new for them. You do have more capabilities if you also have Fortianalyzer receiving the logs from the FGT, as @esalija already described them.