FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Dongfang_Li_FTNT
Article Id 346659

 

Description

This article describes how to customize the admin alert email to be more user-friendly.   

 

When configuring alert email in automation stitches sent to a recipient, by default, all fields in the event log are listed in the email body. 

 

config system automation-stitch

    edit "Test Automation Stitches"

        set trigger "Network Down"

        config actions

            edit 1

                set action "Default Email"

                set required enable

            next

        end

    next

end

 

config system automation-trigger

    edit "Network Down"

        set description "Trigger when a network interface goes down."

        set event-type event-log

        set logid 20099

    next

end

 

config system automation-action

    edit "Default Email"

        set description "Send an email with information on the log event."

        set action-type email

        set email-to "admin@example.com"

        set email-from "fortinet@example.com"

        set email-subject "%%log.logdesc%%"

        set message "%%log%%”

    next

end

 

Below is the alert email received. All fields in the event log are listed in the email body:

 

alert-email-1.PNG

 

The email recipient wants to see part of the log fields instead of all.  For example, date, time and msg fields are enough. It is preferred to one field one line.

Scope FortiGate v7.2 and above.
Solution

Specify date, time and msg variables in set message CLI, with each variable in a separate line. 

 

config system automation-action

    edit "Default Email"

        set description "Send an email with customized information on the log event."

        set action-type email

        set email-to "admin@example.com"

        set email-from "fortinet@example.com"

        set email-subject "%%log.logdesc%%"

        set message "%%log.date%%

%%log.time%%

%%log.msg%%"

    next

end

 

Below is the alert email received. The date, time, and msg are displayed:

 

alert-email-2.PNG