FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Bhuvanesh
Staff
Staff
Article Id 402891
Description

This article describes how to configure a FortiGate to execute CLI commands on a schedule (e.g., every hour) and automatically send the command output to a Microsoft Teams channel via webhook.

 

This method is useful for routine monitoring or diagnostics, such as routing tables, VPN status, or system resources without logging in each time.

Scope

FortiGate.

Solution

To send a notification to MS Teams, FortiGate needs to have an incoming webhook connector address.

Refer to: Create Incoming Webhooks

 

While creating the incoming webhook, please provide FortiGate hostname as a name to get a notification with a specific device hostname.

 

For example:
The hostname of the FortiGate used in this article is 'LAB _FGT', so the Incoming Webhook connector name is set to 'LAB _FGT'.

 

webhook.png


FortiGate Configuration:
Create a Scheduled Trigger in FortiGate GUI.

  1. Go to Security Fabric -> Automation -> Trigger.
  2. Select 'Create New' and name it (e.g., Hourly).
  3. Under Schedule, choose Frequency as 'Hourly' or 'Daily,' etc.
  4. Set the interval as needed.

 

Hourly.png


Create CLI Script Action

  1. In the same Automation Stitch, click “Create New”.
  2. Select CLI Script.
  3. Name it (e.g., Monitoring).
  4. Add the command(s) to run, e.g.: 'diagnose sys sdwan health-check'.

 

Monitoring.png

 

Create Webhook Action to Send Output to Teams

  1.  In the same stitch, select 'Create New' again.
  2. Select Microsoft Teams Notification.
  3. Name it (e.g., Teams notification).
  4. Paste the Teams Webhook URL into the URI field.
  5. Modify the message as 'Text” as “%%results%%:'
  6. Or choose JSON and customize the format
  7. Eg: { "text": "FortiGate CLI Report:\n\n${%%results%%:}" }

 

Teams_notification.png

 

Stitch the Trigger and Actions:

  • In the Same Stitch, select 'Create New' again.
  • Name it ( eg, Teams Notifications-Monitoring)
  • Select the created Trigger.
  • Select the CLI Command as 1st action.
  • Select the Teams Notification as 2nd action.
  • Select 'Ok. '

 

Stitch.png

 

Result: Now, every hour (or configured interval), FortiGate will:

  1. Run the CLI commands configured.
  2. Automatically post the output to Teams channel.


Output:

 

Output.png