Automate Address List with FortiAnalizer/Playbooks/Fortigate

[Lucas1]

Hi People I need to create an automation to save all the malicious addresses that the FortiAnalizer collects/analyzes and automatically save them in a group of addresses for me to block them from the firewall. I want to know if Fortigate and FortiAnalizer can do something like this. I have the FortiSOC version available if it is necessary to do it with Playbooks. The truth is that I did not find anything like that.

[patelr]

Hello @Lucas1 ,

Please review https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-SSL-VPN-failed-logins-with-an-automa.... According to this document, you can see a functionality where an automation stich can add IP addresses into a group.

Thanks, 
Ronak Patel

[HiralShah]

Hello @Lucas1 

You can also use threat feed to block the malicious address list.

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/891236/ip-address-threat-fee...

[salmas]

Hello @Lucas1 

You can create an event handler on FortiAnalyzer to block such failed attempt IPs.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enhance-SSL-VPN-Security-by-blocking-offen...

salmas