Can fortigate autoquarantine AD users based on the number of IPS virus violations they do?

[filiaks1]

Hello,

My question is can fortigate autoquarantine AD users based on the number of IPS virus violations they do?

I see that under the article https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/148620/config-system-automation-act... or the video https://www.youtube.com/watch?v=3vLdto9Yx0U  that I can block bad hosts based on Mac address or source IP address but nowadays users use different computers, so my question is can I make an automation that can automatically block the source AD user (after fortigate authenticates the users) if the users does too many attacks in a specified time frame that trigger the IPS or virus detections?

[flamer]

I don't think so. Also the logic is a bit wrong, the user is not infected, their machine is, so same user connecting to another machine won't necessarily mean it is also infected. Another user connecting to the initial infected machine means they would be infected. So really we care about IP/MAC only.

[filiaks1]

I agree about compromised users that blocking by IP address or mac address is the better option but I see it as to also block an attacking source user if they decide to switch to another computer.