Technical Tip: Automating Daily Security Event Summaries with FortiGate

Raghu_Kumar · ‎10-28-2024

Description

This article describes how to configure FortiGate to automatically send a daily security rating summary to the security team via email for regular monitoring and response.

Scope

All FortiGates.

Solution

To automate the process of sending daily summaries of security ratings, FortiGate's automation stitch feature can be leveraged. This solution will allow FortiGate to send a summary of security ratings and send it via email to designated recipients.

Define the Automation Trigger:

Create a trigger using FortiOS Event Logs and search for 'Security Rating summary'.

FortiGate (Daily-Security-Summary) # sh full
config system automation-trigger

edit "Daily-Security-Summary"
set description ''
set trigger-type event-based
set event-type ioc

next
end

Define the Automation Action:

Create an action to send an email of a security rating summary.

FortiGate (Daily-Security-Summary) # sh full

config system automation-action
edit "Daily-Security-Summary"
set description ''
set action-type alert
set minimum-interval 0
next
end

Create the Automation Stitch:

Combine the trigger and action into an automation stitch that ties the two together.

FortiGate (Daily-Security-Summary) # sh full
config system automation-stitch
edit "Daily-Security-Summary"
set trigger "Security Summary"
config actions
edit 1
set action "Email Notification"
set required enable
next
end
next
end

Verification:

After setting up the automation stitch, monitor the email inbox to ensure that the rating summary is sent daily.
Adjust the configuration as necessary based on testing.

Note:
Make sure alert email settings are configured.
Technical Tip: How to configure alert email settings