Custom Playbook to notify for any Outbreak Alert FAZ

[gwaihir]

Greetings.

Hi, I would like to create a custom PB to run a report and then notify any Outbreak Alert detection.

I started with:

1. Event trigger (basic handler name --> contains --> "Outbreak Alert")

2. Create Incident

3. Attack data to incident

4. Run report (about incidents)

There are a problem, when creating the PB, it seems that Event Trigger doesn't accept  "Outbreak Alert" as "basic handler name" using CONTAINS, only specific handler names.

How can this be achieve? 

Thank you!

[Anthony_E]

Hello gwaihir,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[vraev]

Please review the following articles:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-a-custom-playbook-using-...

https://docs.fortinet.com/document/fortianalyzer/7.2.2/administration-guide/28682/playbooks
https://docs.fortinet.com/document/fortianalyzer/7.2.2/administration-guide/691884/configuring-playb...
https://docs.fortinet.com/document/fortianalyzer/7.2.2/administration-guide/813113/analyzing-an-inci...
https://docs.fortinet.com/document/fortianalyzer/6.4.0/new-features/447371/default-playbook-template...
https://docs.fortinet.com/document/fortianalyzer/7.0.0/new-features/949810/importing-and-exporting-p...
https://docs.fortinet.com/document/fortianalyzer/7.2.2/administration-guide/763118/configuring-tasks...
https://docs.fortinet.com/document/fortianalyzer/6.4.0/new-features/893685/automation-playbooks

[Jack_wack]

show us a screenshot of the trigger settings