Automate Rogue AP Classification?

[tanr]

I just started looking at automation in 6.0.x Security Fabric for FortiGate, FortiAP, and FortiAnalyzer.

I was hoping I could automate Rogue AP classification by handling an Event Log for "Rogue AP detected" and classifying it as accepted if SSID doesn't match any of our current SSIDs and the power level is below a medium noise threshold. 

But handling the Event through the Fortigate's Security Fabric Automation gives me no additional data to create rules on, and handling it through the FortiAnalyzer I don't see a good way to connect it to web hooks or script.

Am I missing something obvious, should this be feasible, or am I off base?

Thanks.