Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Tonny
New Contributor

Notification slack and/or teams

Hi,
I'm running the fortianalyser (7.4.0 GA Build 2223) and tried to set up notifications to slack as well as teams, but with not much success.

We tried to follow the manual https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/382184/slack-notification-ac... .... the gui is a bit different, and the CLI procedure fails at step 1; there is no command "config system automation-trigger"

 

So we went along with just look en fill in 'logical' values. What we have so far:
1) under "Fabric view" -> "Fabric connectors" -> "ITSM" -> "Generic connector"
  there is a slack connector with in the HTTP Body "{\"channel\": \"#siem\", \"text\": \"%%log%%\" }"

  (for the teams and slack connectors don't show up in the next step)
2) under "Incidents & Events" -> "Notication profiles"
  there is a profile with "Send Alert through Fabric Connectors" enables and pointing to the connector from step 1

3) under "Incidents & Events" -> "Basic Handlers" 

  i created an new handler to notify all that is log-level <> debug

 

In Slack I litterly see "%%log%%" on each event.
I also tried HTTP Body "{\"channel\": \"#siem\", \"text\": event_id }" and many variations, but nothing gives me notifications with text related to the event. Only literal stings are coming thru.

Any suggestions on how it should be configured ?

 

//Tonny

1 REPLY 1
Tonny
New Contributor

I've also tried via "Fabric view" -> "automation" There I only see the teams connector, not the slack or the generic one. A playbook with a teams connector works a little better (could text some field) but still not useful.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors