Alert when ip goes in quarantine

[DanieleS99]

Hi,

I'm trying to figure out how to send an alert when an ip address is quarantined by the dos policy...
Does anyone know how to do this through automation stitches?

Thanks

[Debbie_FTNT · Accepted solution]

Hey Daniele,

there should be event logs like

22850 - LOG_ID_USER_QUARANTINE_MAC_ADD

or
43776 - LOG_ID_EVENT_NAC_QUARANTINE

-> check your system event logs on FortiGate

You can create an automation stitch to trigger on the event log message; this is triggered based on the log ID. The last five numbers of the log ID are the specific log message ID that an automation stitch will trigger on.

[DanieleS99]

Thanks, it works.