Can fortigate autoquarantine AD users based on the number of IPS virus violations they do?

[filiaks1]

Hello,

My question is can fortigate autoquarantine AD users based on the number of IPS virus violations they do?

I see that under the article https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/148620/config-system-automation-act... or the video https://www.youtube.com/watch?v=3vLdto9Yx0U  that I can block bad hosts based on Mac address or source IP address but nowadays users use different computers, so my question is can I make an automation that can automatically block the source AD user (after fortigate authenticates the users) if the users does too many attacks in a specified time frame that trigger the IPS or virus detections?

[flamer]

I don't think so. Also the logic is a bit wrong, the user is not infected, their machine is, so same user connecting to another machine won't necessarily mean it is also infected. Another user connecting to the initial infected machine means they would be infected. So really we care about IP/MAC only.

[filiaks1]

I agree about compromised users that blocking by IP address or mac address is the better option but I see it as to also block an attacking source user if they decide to switch to another computer.

[filiaks1]

Also with Fortifabric I recently tested automation stich ip-ban but unfortunatly there is no user ban.

How to ban IP through automation stitch - Fortinet Community

As workaround the action could be with Fortiauthenticator involved to send API command to it to ban the user. Maybe this will be a good community article ?

Webhook action | FortiGate / FortiOS 7.6.3 | Fortinet Document Library