DNS filter and dynamic group

[MORAMADAN]

Hello Friends,

                    I have DNS filter profile and applied on the internet accessing security roles.

I need "if possible" to configure what like a dynamic object group that contains all hosts that are trying to connect to any malicious domain.

is this applicable in fortios? and how please.

Fortios ver. 7.x

TIA,

[AEK]

Hello Ramadan

I think you can do it with automation stitch, using trigger "Compromised Host Quarantine", than as action you may write a script to add the address to the group.

Hope it helps.

Edit: Forgot to mention, for that you also need FortiAnalyzer

[AlexC-FTNT]

That's a feature that requires advanced Network monitoring tools (SIEM).

Something similar can be done (to some extent) when a FortiAnalyzer is configured to collect logs.
You can either set up playbooks in FAZ, or set up automation stitch to trigger events based on the logs appended by FAZ:

https://docs.fortinet.com/document/fortianalyzer/7.6.0/administration-guide/106885/playbook-template...

[MORAMADAN]

Thank you gentelmen, I think I will pass since I dont have SEIM or fortiAnalyser. at least for time being.