Create an alert under Settings->Searches, Reports, and Alerts->New Alert
In Search field: fill out Search field based on the CIM datamodel if Enterprise Security and FortiGate Add-on has been installed and FortiGate has been reporting logs to the Splunk
| datamodel "Malware" "Malware_Attacks" search
OR
sourcetype=fgt_utm subtype=virus action=blocked
if only FortiGate add-on has been installed;
Choose FortiGateActions and select the field to block if an event matches the search.
After logs matching the search has been detected, there will be a firewall policy
added in the FortiGate which trigged the event. The policy will include a
comment "fgt_ar" for users to easily identify.
Make sure the add-on has been set up with FortiGate's information including correct device id, admin password, IP address and the IP address enables https access.
If set up is correct, you can get more information about the issue by searching:
index="summary" sourcetype="fortigateresponse"
in Search&Reporting.
$SPLUNK_HOME/var/logs/splunk/FortiGateActions_modalert.log
python3 migration
add name field in auto-generated firewall policies
1.0.2:
-fix session logout issue
Fix compatibility issue with FOS6
1.0.0
1. Initial release of Fortinet Active Response Add-on for FortiGate
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.