FAZ advanced event handler

[JonasV]

Hi community.

I'm looking for a way, to build an Event handler in FAZ with the following requirements.

Tricker an alert in case of.
Log received from FortiAuthenticatorwith mulitple log descriptions: ' EAP_AUTH_START' but with absence of any following log description equal to: ' DOT1X_AUTH_OK'

I've experienced more then once, that our FAC is receiving multiple EAP_AUTH_START, but the auth process is stucked and the appliance needs a reboot.

I was hoping this kind of event handler would notify me in case it happens again.

Kind regards

[atticus05]

Looking at taking all of my raw data and dumping into a JSON to import into FAZ as an event handler, any tips on the script sir? Cheers