Technical Tip: How create event handler in FortiAnalyzer for policy change in FortiGate

[tnaik]

Description

This article describes how to create an event handler in FortiAnalyzer for a Policy change in FortiGate and send an email to the administrator.

Solution

1. Create a mail server.
   
   Log in to FortiAnalyzer, go to System setting -> Mail Server and select 'Create new'.
   
   Now enter the mail server details.
   
   

2. Test the email server working status.
   
   Select 'Mail Server' and select the mail server created in step 1. After, select 'Test'.
   
   A notification message pops up immediately on the same page.
   
3. Log in to FortiAnalyzer, go to Incident and Event -> Event Handler list, and select 'Create New'.
   
   Enter the details below:

Now, on the same page, enter the notification details:

To: destination email address.

From: source email address which is present in the mail server.

Mail Server: created in Step 1.

Test.

Try to change any policy in FortiGate that receives email notifications on the email address mentioned.

Related articles:

• Technical Tip: How to set up Email Notifications with notification.fortinet.net
• Technical Tip: How to create Event handler in FortiAnalyzer for Policy delete in FortiGate
• Technical Tip: How to configure email alerts for configuration changes on FortiGate using FortiAnaly...
• Technical Tip: Setting up a FortiAnalyzer event handler with a specific time schedule
• Troubleshooting Tip: How to understand the email SMTP issues and its causes
• Troubleshoot: FortiAnalyzer unable resolve DNS to mail server