Technical Tip: Configure a playbook to use an event related to the FortiGate change status and send the event report to a specific email

[HernandezA]

Description	This article describes the configuration steps to create a playbook that will run a report about system events when a FortiGate Interface changes its status.
Scope	FortiAnalyzer, FortiGate.
Solution	General information: FortiGate VM, version 7.4.7 Build2731. FortiAnalyzer VM version 7.4.7 Build2685. Pre-requisites: Register FortiGate into FortiAnalyzer (connection status UP). Verify the status connector Fabric View -> Automation -> Connectors -> FortiOS Connector (Green/UP). Confirm event logs are being received Log View -> FortiGate -> Event: All Types. Configuration steps: Configure Mail Server settings under System Settings -> Advanced -> Mail Server -> Create New. Refer to Technical Tip: How to set up Email Notifications with notification.fortinet.net. Create a report that will be executed. In this example, the report will be created from a template available in FortiAnalyzer (Security Events and Incidents Summary). Note that the administrator can use the best report for specific information needs, which means a report can be chosen from a template or a customized report. Go to Reports -> Report Definitions -> Templates -> Security Events and Incidents Summary -> Create Report.  After report creation, ensure the options 'Extended Log Filtering' and 'Enable Auto-Cache' are enabled. These are essential. Link the playbook in the steps after, and select 'Apply'. Create an Output profile to link with the report notification options. Go to Reports -> Advance Settings -> Output Profile -> Create -> Configure settings according needs. In this example, PDF format will be used for email generated reports. Select the Email server configured in point 1, and use the sender and destination email addresses.  Return to Report settings and check the 'Enable notification' box, then select the Output profile was configured in point 3. Reports -> Report Definitions -> Edit Report created -> Check 'Enable notification' -> Select Output Profile. In summary, the report settings should at least have enabled the options like the following picture. (The last 3 points can be reviewed in Technical Tip: How to configure email server on FortiAnalyzer to receive reports over email). Configure an Event handler according to requirements. This example will use a handler cloned from a default basic handler called 'Default-NOC-Interface-Events' due to it already containing the Rule that is needed to identify when an interface of FortiGate changes from UP to Down and vice versa. Go to Incident & Events -> Handlers -> Basic Handlers -> Default-NOC-Interface-Events -> Select Handler and Clone. When cloning the Event Handler, the administrator needs to name the new rule and ensure the status is Enabled, then select 'OK' and ensure the 'Automation stitch' option is Enabled. Create a new playbook under Fabric View -> Automation -> Playbook -> Create New -> 'New Playbook created from scratch'. In this example, it will be used for the trigger 'EVENT_TRIGGER', and will configure the condition to begin the flow. In this case, 'Any of the following conditions' was used. Basic Handler Name was selected, along with Equal to, and the Name of Handler that was configured in step 6. EVENT TRIGGER -> 'Any of the following conditions' -> Selected Basic Handler Name -> Equal to -> Name of Handler: TEST _interface_handler_playbook_Default-NOC-Interface-Events -> Save. Create a New connector step extending the point in the EVENT TRIGGER and select the FortiAnalyzer option. Set the Name of the connector, verify the Connector option is 'Local Connector', confirm the Action is 'run report', select the report that was configured in previous steps, choose the Time Period, and select OK. In this example, no filter is used. Save the playbook. Testing the playbook. Go to FortiGate and select an interface that can be turned off/on to generate the event. In this example, port2. Go to FortiGate Events in FortiAnalyzer and confirm the events were received. Log View > FortiGate > verify interface-stat-change action. Verify the Event Monitor has registered the events. Go to Incident & Events -> Event Monitor -> All Events. Verify Playbook status and execution result. Go to Fabric -> Automation -> Playbook Monitor. Confirm the Report was executed. Confirm E-Mail reception in the email application used by the configured receiver.