Skip to main content
rezafathi
rezafathi
Explorer III
May 30, 2024
Question

Fortianalyzer event handler

Hi

I have created an event handler on FAZ to identify which IP is trying to download the virus and then created a stich on FGT to ban ip of that user, but it does not work when i try to downloaf eicar test virus. The screenshot is my FAZ configuration. Thanks.

 

1000085397.jpg

 

10 replies

ozkanaltas
ozkanaltas
Valued Contributor III
May 30, 2024

Hello @rezafathi ,

 

When you download the eicar test file, is the log created on FortiAnalyzer or not? 

 

If you say yes, is this log id the same as "0211008192" or not? 

 

Also, can you share the automation stitch configuration with us?

    rezafathi
    rezafathiAuthor
    Explorer III
    May 30, 2024

    Hi

    Yes logs is created. And logid is same.

     

    1000085435.jpg

     

    ozkanaltas
    ozkanaltas
    Valued Contributor III
    May 30, 2024

    Hello @rezafathi ,

     

    Do you see any count on the Event Handler Events column? 

     

    image.png

      Terms & ConditionsAccessibility statement
      Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
      Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
      Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT