Technical Tip: Automation Stitch using Event Handlers from FortiAnalyzer and trigger it in multiple devices

[jcovarrubias]

Description	This article describes the configuration of Automation Stitches within a security fabric and provides an overview of how to confirm the correct execution in the fabric.
Scope	FortiAnalyzer, FortiGate with CSF.
Solution	This document assumes that FortiAnalyzer and FortiGate have been configured successfully for: Event Handler. Security Fabric. For reference on how to set these up, see the following documents: Technical Tip: Automation Stitch for Event Handlers Deploying the Security Fabric - FortiGate 7.6.2 administration guide When configuring the stitch within the security fabric, the following elements must be selected. FortiGate(s) field. The devices selected on this list will be the subject of applying the actions defined in the Stitch. The configuration above triggers the automation stitch in both F2 and F9. In this scenario, F2 is the root while F9 is downstream. After the stitch is triggered, these elements can be reviewed to confirm: On the GUI of the ROOT FortiGate: Note that non-root devices cannot see the automation window. It will show the following: In the CLI: F2 # diag test application autod 2 csf: enabled root: yes sync connection: connected version:1747921654 sync time:Thu May 22 09:55:18 2025 total stitches activated: 3 stitch: Stich1 destinations: Stich1; trigger: HANDLER type:faz event field ids: (id:null)triggername=Handler1ZZZ   <----- Event Handler name. (id:304)severity=medium (id:null)tag=tag1   <----- Event Handler Tag (if configured). local hit: 1 relayed to: 3 relayed from: 2  <----- Increments upon trigger. actions: BAN-test-IP type:cli-script interval:0 delay:0 required:yes script:config firewall address In the non-root FortiGate (F9), the counters also increment: F9 # diagnose test application autod 2 csf: enabled    root: no        sync connection: connected version:1747921654 sync time:Thu May 22 09:55:22 2025 total stitches activated: 3 stitch: Stich1         destinations: Stich1;         trigger: HANDLER                 type:faz event                 field ids:                         (id:null)triggername=Handler1ZZZ                         (id:304)severity=medium                         (id:null)tag=tag1         local hit: 0 relayed to: 0 relayed from: 1 <----- Counters increment.         actions:                 BAN-test-IP type:cli-script interval:0                         delay:0 required:yes Counter explanation: In the automation, the Stitch is configured to fail when there is a failed authentication 3 times within 1 minute. The switch gets triggered in the following way. If the logging attempts were in F9, F9's local and relayed to counters will increase while the F4s relayed from the counter will increment.