Quarantine a device from FortiAnalyzer playbooks

[venesa00]

Hi!

I was wondering what changes do I have to make in my Fortigate, in the automation section, to automate the quarantine of an endpoint from FortiAnalyzer (with the playbook)?

I can run the playbooks to create incidents if it detects a compromised host, but I would like to quarantine them as well with another playbook. Do I have to create a sticth first on my Fortigate?

Thanks.

[gfleming]

Lots of good info here: https://docs.fortinet.com/document/fortianalyzer/7.2.2/administration-guide/691884/configuring-playb...