FortiGate Automation-Send Microsoft Teams Notification

Hello every one , in this video I will introduce how can you integrate your fortigate firewall with Microsoft teams and get notification in case of admin login failed, Also I will describe fortigate automation service to do some actions for triggered events.

1. Configure Microsoft Teams Incoming Webhook:

• Log in to your Microsoft Teams account and navigate to the channel where you want to receive notifications.
• Click on the three dots (…) next to the channel name and select “Connectors.”
• Search for “Incoming Webhook” and click on it to configure.
• Give your webhook a name and customize its settings, such as the icon that will be displayed with messages.
• Once configured, a unique webhook URL will be generated. Copy and save this URL, as you’ll need it to send notifications from FortiGate to Teams.

2. Configure FortiGate Automation:

• Access your FortiGate firewall’s web interface or CLI.

a. Define Triggering Events:

– Depending on your specific use case, you’ll want to define the events or conditions that trigger notifications. For example, you might want to send notifications when: – A critical security event is detected (e.g., intrusion attempts, malware activity). – A specific network condition is met (e.g., bandwidth threshold exceeded). – Configuration changes are made on the firewall.

b. Create a Custom Script or Action:

• FortiGate Automation typically involves creating custom scripts or actions using FortiScript (for CLI-based automation) or FortiManager (for GUI-based automation).
• Here’s an example of a custom FortiScript that sends a notification to Microsoft Teams using the webhook URL:

  # Define the Microsoft Teams webhook URL
  set teams_webhook_url "https://yourteamswebhookurl"

  # Define the message to send
  set message "A critical security event has been detected on FortiGate!"

  # Construct the JSON payload
  set json_payload '{"text": "'$message'"}'

  # Send the HTTP POST request to Microsoft Teams
  execute log "Sending Microsoft Teams notification..."
  execute external "post $teams_webhook_url" $json_payload

c. Customize the Message:

- You can customize the message within the script to include details about the triggered event, such as date, time, event type, and any relevant information.

3. Test the Automation:

• To test the automation, trigger the event or condition that should initiate the notification. Check Microsoft Teams to ensure that the message is sent and received correctly.

4. Enable the Automation:

• Once you have successfully tested the automation and are confident in its functionality, you can enable it in your FortiGate configuration.

5. Monitoring and Fine-Tuning:

• Regularly monitor the automation to ensure that it continues to work as expected. If needed, you can make adjustments to the script or action to meet changing requirements or address any issues that may arise.

By following these detailed steps, you can set up a robust automation system within FortiGate to send Microsoft Teams notifications whenever specific events occur, helping you stay informed about critical network and security events in real-time.