Including ADOM Information in FortiAnalyzer Playbook Webhook Actions

[fortinet_sdwan]

Hello Fortinet Community,

I'm currently working with FortiAnalyzer (version 7.4.x) and have set up an automation playbook that triggers upon specific events, such as multiple failed login attempts. The playbook includes a webhook action intended to send event details, including the ADOM (Administrative Domain) information, to an external system.

In my webhook action, I'm attempting to include the ADOM using the ${adom} macro in my automation Playbook.

However, the adom field in the payload is coming through as blank. I understand that in notification profiles, the ADOM information is readily available, but it seems that in the context of playbook actions, this macro isn't being populated.

I've reviewed the FortiAnalyzer documentation, particularly the section on webhook connectors and supported macros , but it doesn't provide clarity on this specific issue.

Has anyone encountered this problem or found a workaround to include the ADOM information in playbook webhook actions? Any guidance or suggestions would be greatly appreciated.

Thank you!
FortiAnalyzer 

[Jean-Philippe_P]

Hello fortinet_sdwan, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello again fortinet_sdwan,

I found this solution, can you tell me if it helped? 

In FortiAnalyzer, the use of macros like `${adom}` in playbooks can sometimes lead to issues if the context in which they are used does not support them. Here are some steps to troubleshoot and resolve the issue:

1. Verify Macro Support: Ensure that the `${adom}` macro is supported in the context of the webhook action within your playbook. The documentation may not explicitly state this, so testing with other macros that are known to work can help determine if the issue is specific to `${adom}`.
   
   
2. Check Playbook Configuration: Double-check the playbook configuration to ensure that the ADOM context is correctly set and that the playbook is triggered within the correct ADOM. Sometimes, the ADOM context might not be correctly passed to the playbook.
   
   
3. Test with Other Macros: Try using other macros that are known to work in the same context to see if they populate correctly. This can help determine if the issue is specific to the `${adom}` macro.
   
   
4. Review Event Context: Ensure that the events triggering the playbook contain the ADOM information. If the events do not have this information, the macro will not be populated.
   
   
5. Update FortiAnalyzer: If possible, consider updating to a newer version of FortiAnalyzer where this issue might have been addressed. Sometimes, newer versions include bug fixes and enhancements related to macro support.
   
   
6. Contact Support: If the issue persists, consider reaching out to Fortinet Support for further assistance. They may have additional insights or solutions specific to your version and configuration.