Technical Tip: Telegram Notification for FortiADC

[gsharma]

Description	This article describes how to send notifications from FortiADC to Telegram App using Action type as Webhook
Scope	FortiADC-VM, FortiADC.
Solution	FortiADC has multiple Automation Action types, which are possible to view in On the Security Fabric -> Automation -> Action tab. There is a list of available automation response actions. It s possible to define the automation actions and then can combine them with a trigger to create an automation stitch. The web-mode of Telegram will be used for better understanding. To Begin with, first test connectivity from the FortiADC to api.telegram.org: Bezza-kvm32 # execute ping api.telegram.org PING api.telegram.org (149.154.167.220): 56 data bytes 64 bytes from 149.154.167.220: icmp_seq=1 ttl=55 time=164.2 ms 64 bytes from 149.154.167.220: icmp_seq=2 ttl=55 time=164.1 ms If ping is not happening, it will not be possible to receive the notifications. Configure Telegram first and create a BOT account. Open web.telegram.org, sign in. In the search bar type @BotFather. Type in the message there as /start. Multiple options will appear. Send the next message as /newbot. Create a BOT by giving a unique name. Once the BOT user is created, below message will  appear: This number: code will be used later in FortiADC. Create a new group and add this BOT user to that. Now, when that group is opened in the address bar, the link: web.telegram.org/k/#-randomnumber will be visible Configure FortiADC. Go to Security Fabric -> Automation -> Action tab and select 'Create new'. Name: Reference Action Name Protocol: HTTPS Method : POST URL: api.telegram.org/botAPI-IDin the group created/sendMessage For ex: api.telegram.org/bot6668449:AAGibEcMKQFHShunBtYGpECLiMOZFFP1r0U/sendMessage Format have to be exactly like this: /botrandomnumber:randomcode/sendMessage HTTP Body: {"chat_id": "-group number in the telegram web ", "text": "%%alert_msg%%"} For Example: {"chat_id": "-8672925", "text": "%%alert_msg%%"} HTTP Header: Content-Type:application/json  Save.  Go to Security Fabric -> Automation and select 'Create New'. Name:  Stich Name Status: Enable Egress Vdom: Local Trigger. Select the Type of Trigger to use. For this example, System Events is used. Apply to: All or VS or RS Event: Select predefine events Action: Select Webhook Give name for Webhook and in Action Dropdown call the Action created earlier. Delay : Range: 0-3600 seconds after previous action (if multiple actions). Save. To test this, Logout or log in to the GUI interface. A notification along will appear with IP: Related document: Creating automation stitches It is possible to use this for different kinds of triggers and create policy for this. Each Automation Policy will be for a single type of Trigger only.