Atutomation: CLI action - grab "Remote IP"

[RobertC]

Hello,

I'm trying to grab IP address from the log after ssl-login-fail and create new Firewall->address and append it to existing group using CLI script:

Log event looks like this:

date=2024-01-17 time=11:11:19 id=7325007792115286044 itime="2024-01-17 11:11:19" euid=1049 epid=3 dsteuid=3 dstepid=3 logver=700130566 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="admin" remip=5.153.183.36 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_permission_denied" eventtime=1705486279485398543 tz="+0100" devid="FG100E4Q17012295" vd="root" csf="TCCM_SF" dtime="2024-01-17 11:11:19" itime_t=1705486279 devname="EDGECLUSTER_FG100E"

 I see that IP address in question is named remip

My script follows:

config firewall address
edit %%remip%%_SSL_VPN
set subnet %%remip%% 255.255.255.255
next
end

config firewall addrgrp
edit Banned_SSLVPN
append member %%remip%%
next
end

but the result is nothing, no address entry is created. How can I debug it (or at least check some logs)?

PS: the stitch input is FAZ log

Thanks

Robert

[RobertC]

Yeah,

I understand how it's supposed to work. I made a support ticket to ask for help, because I have no idea how to alter output of FAZ handler.

Thanks

Robert

[Bjay_Prakash_Ghising]

Hi @RobertC 

You may refer to the following attached article. 

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-create-an-Event-Handler-in-FortiAn...

It might give you some idea to work with your requirements. 

Hope it helps, 

Kind Regards, 

Bijay Prakash Ghising

[RobertC · Accepted solution]

Well,

for the sake of archives....

There is a confirmed bug in FortiAnalyzer 7.2.x, which causes that srcip is not send in the log back to Fortigate so the script trying to grab this value can't work. Recommended solution is to upgrade FAZ to 7.4.x

HTH

Robert