Scheduled Report of Blocked IPs on FGT

[mohamed44]

Hi Team,

I blocked many IPs on FGT daily is it applicable to send daily report of the blocked IPs in that Day with the Reputation associated with each IP

Thanks in advance,

FortiSOAR

#Schedule

[dspille · Accepted solution]

This should be pretty easy to do if you have an associated indicator record for the IP's you're blocking. Whenever you block an IP, the status field can be set to "Blocked". Then you can create a report of all IP's blocked within the past day.

[oerkan]

Thanks dspille,

In addition to your contribution, if Mohamed is blocking IPs both on FortiGate and elsewhere, there should be a field in the indicator module that holds the device which he is blocking IPs on.

So SOAR can generate a specific report including IPs blocked on FortiGate.