Technical Tip: Configure an Automation Stitch to send Administrator Login Failed alerts to Telegram

[lmassip]

Description	This article describes how to configure a FortiGate Automation Stitch that sends a Telegram message when an Administrator login failure event occurs.
Scope	FortiGate
Solution	Telegram prerequisites (Bot Token, Group, Chat ID). Create a Telegram bot and obtain the Bot Token. Create a bot using BotFather in Telegram. Record the bot token  Create a group chat and add the bot Create a Telegram group chat. Add the bot to the group as a member. Ensure the bot has permission to post messages in the group Obtain the Chat ID Record the chat ID for the group Validate Bot Token and Chat ID (Telegram API direct test). Send a test message using the Bot API. Use the following format in a browser: https://api.telegram.org/bot<BOT_TOKEN>/sendMessage?chat_id=<CHAT_ID>&text=Hello Expected result:  The Telegram group receives the message. The API response returns ok:true. FortiGate connectivity validation to Telegram. In the FortiGate CLI, run the following: execute ping api.telegram.org Configure the Automation Stitch on FortiGate (GUI). Create a new Automation Stitch Go to Security Fabric -> Automation -> Stitch. Select Create New. Set Name: Telegram_Alerts (example). Configure the Trigger (Administrator login failure): Under Trigger, select Event Log (or the FortiOS event-based trigger available in the FortiOS build). Select the event that matches Administrator login failures. Save the Trigger. Configure the Action (Webhook to Telegram). Under Actions, select Add Action. Select Webhook. Select Create New. Verification. Trigger an Administrator login failure event. Attempt an admin login with an incorrect password. Confirm that an event is generated in logs. Confirm that the Telegram group receives the message.