Fortianalyzer event handler

[rezafathi]

Hi

I have created an event handler on FAZ to identify which IP is trying to download the virus and then created a stich on FGT to ban ip of that user, but it does not work when i try to downloaf eicar test virus. The screenshot is my FAZ configuration. Thanks.

 

[ozkanaltas]

Hello @rezafathi ,

When you download the eicar test file, is the log created on FortiAnalyzer or not? 

If you say yes, is this log id the same as "0211008192" or not? 

Also, can you share the automation stitch configuration with us?

[rezafathi]

Hi

Yes logs is created. And logid is same.

 

[ozkanaltas]

Hello @rezafathi ,

Do you see any count on the Event Handler Events column? 

[rezafathi]

Yes

[ozkanaltas]

Hello @rezafathi ,

Do you see the trigger count on your FortiGate?

Also, can you check the ban status with this command? 

diagnose user banned-ip list

[rezafathi]

Yes i see trigger count. And I checked the command but no ip ban.

[ozkanaltas]

Hi @rezafathi ,

That interesting. I tried same scnerio on my lab environment, everything works well.

Maybe someone faced with this issue. Also, if you have a active license you can create a case to fortinet support. Support engineer will inspect problem deeply.

[rezafathi]

Hi

I do not see any trigger count on fortigate. Should i enable central management on fortigate? Because it is disabled.

[ozkanaltas]

Hi @rezafathi ,

Ne needs central management configuration. Maybe reconfiguring eventhandler and automation can solve the problem.