Playback option for IP block on fortigate

[waheed87]

Is there a way to playback option in FortiSOAR to see the entire IP block on fortigate from playbook action.

Thanks

[Jtamboli]

Hi waheed87,

To achieve this, you can install Fortinet FortiGate v5.3.0, which will be released soon in the coming week. This version allows you to block multiple IP addresses simultaneously and review the entire IP block on FortiGate directly from the playbook action in FortiSOAR. Below, I've attached screenshots for your reference to help you visualize the process.

Thanks 
Junaid

[waheed87]

Hi Thank you so much for coming back. However my question is for example if one IP is blocked then can i replay it like i try to add that IP again or see the whole process in single space. 

[Jtamboli]

Hi waheed87,

I understand your question now. Yes, in FortiSOAR, you can replay actions within the playbook. If you have blocked an IP address, you can re-execute the blocking action by manually triggering the playbook step that performs the IP block. This allows you to simulate the process or apply the block again if necessary.

But when re-executing, if you add new IPs, those IPs will be displayed in the newly_blocked field in the output. If the IPs were already blocked previously, they will appear in the already_blocked field, as shown in the screenshots below.

Additionally, if you want to view the entire list of blocked IPs, you can execute the Get Blocked IP Address action to see a comprehensive list of all blocked IPs.

Below are the screenshots for your reference to help you visualize the process, hope this helps :)

Thanks
Junaid

[waheed87]

Thanks dear. will test it in lab.