scripts in FortiGate

[unknown1020]

good morning friends.
Based on your experience in this fortinet world, do you think that scripts are a good practice to mitigate attacks?
Those scripts could be used in automation stitch

[HarshChavda · Accepted solution]

Fortinet solutions like FortiGate, FortiManager, and FortiAnalyzer provide APIs and integration points where custom scripts can be used for automation and enhanced security. FortiGate firewalls, for example, can be configured using REST APIs, allowing for automated rule updates, monitoring, and other tasks. Scripts can be a good practice for mitigating attacks if they are well-designed, thoroughly tested, and properly maintained. They can be particularly effective when used in conjunction with a comprehensive security strategy that includes other layers of protection. 

You can write a script to automatically back up your FortiGate configuration at regular intervals. This ensures that you can quickly restore your settings in case of a failure or security incident. Scripts can be used to dynamically update firewall rules based on threat intelligence feeds or internal conditions. For example, if a new malicious IP is identified, a script can automatically update the firewall rules to block traffic from that IP. You can use scripts to monitor various metrics like CPU usage, memory usage, and network throughput. If any of these metrics cross a certain threshold, the script can send an alert to the administrators. If you're using VPNs, scripts can help automate the process of adding or removing users, updating security settings, and monitoring VPN status.

FortiGate offers RESTful APIs that can be used to interact with the device. You can use languages like Python, PowerShell, or Shell scripting to make API calls for automation tasks. If you're using FortiManager, you can use its scripting capabilities to manage multiple FortiGate devices centrally. It is always recommended to test your scripts in a controlled environment before deploying them in production to ensure they work as expected and don't introduce new issues. By combining the power of scripting with FortiGate's robust security features, you can create a more resilient and efficient network environment.

[hbac]

Hi @unknown1020, 

I'm not sure if FortiOS CLI scripts can mitigate attacks. You can refer to security best practices to mitigate attacks instead. Please refer to https://docs.fortinet.com/document/fortigate/7.4.0/best-practices/830840/network-security

Regards,