FAZ 7.x.x Correlation Event Handler using Wildcards/Pointer

[FortiTowel]

Hello FortiCommunity,

i try to figure out is there any possibility to correlate Logs for SSL-VPN Events,

i wanna get notified (or may User Quarantied). For example when Remote-User A, etablish tunnel first with remote-ip xxx.xxx.xxx.xxx (Netherland) and 1 Hour later Remote-User A, etablish tunnel with remote-ip xyx.xyx.xyx.xyx (Brazil),

of course i could say on FGT, single user VPN Session/Tunnel, but i think normaly it should be possible to set WildCard/Pointer on FAZ, for Matching Criteria.

If someone already asked nearly the same Question, just post the Link, thanks!

Thanks for any idea

Towel

[vraev]

Hi @FortiTowel ,

Take a look through the following articles:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-create-an-Event-Handler-in-FortiAn...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-Ban-IP-using-event-handler-auto...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-How-to-configure-an-Event-Handler-wit...

https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/348606/creating-a-custom...

Best,

[FortiTowel]

Hello Vraev,

thank you sharing the related urls with me.

It looks like a need to talk to my Account Manager for Feature Request.

Cheers

FortiTowel