Automation stitches


In this recipe, you configure Automation stitches for your Fortinet Security Fabric. Each Automation pairs an event trigger and one or more actions, which allows you to monitor your network and take appropriate action when the Security Fabric detects a threat. You can use Automation stitches to detect events from any source in the Security Fabric and apply actions to any destination.

This recipe is in the Fortinet Security Fabric Collection. You can also use it as a standalone recipe.

In this example, you create the following Automation stitches:

  • Ban a compromised host’s IP address.
  • Send an email alert when HA failover occurs.

In this example, the Security Fabric consists of Edge, an HA cluster that is the root FortiGate of the Security Fabric, and three ISFW FortiGate devices (Accounting, Marketing, and Sales). You configure the Automation stitches on the root FortiGate and the settings are synchronized with the other FortiGate devices in the Security Fabric.

1. Creating the Automation stitches


To create a new Automation that bans the IP address of a compromised host, go to Security Fabric > Automation.

Set FortiGate to All FortiGates.

Set Trigger to Compromised Host. Set IOC level threshold to High.

Set Action to IP Ban.

Create a second Automation that sends an email alert when HA failover occurs.

Set FortiGate to Edge-Primary, which is part of the only HA cluster in the Security Fabric.

Set Trigger to HA Failover. Set Action to Email.

Set the Email subject and email address to send alerts to.


2. Testing the Automation stitches

If your FortiOS version is 6.0.2 or higher, to test the Automation stitches go to Security Fabric > Automation, right-click the Automation, and select Test Automation Stitch.

If your FortiOS version is 6.0.0 or 6.0.1, use the following instructions to test the automation stitches.

Instead of testing the Automation that blocks compromised hosts, the following steps simulate its effects by manually blocking the IP address of a PC on your network.

Go to Security Fabric > Physical Topology and locate a PC on your network. Right-click the PC and select Ban IP.


Set Ban Type to Temporary. Set Duration to 30 minutes.

To test the Automation for HA failover, go to Edge-Primary. In the administrative drop-down menu, select System > Reboot.

Set an Event log message.


3. Results 

If you have simulated the the Automation that blocks compromised hosts, the banned device can no longer access the Internet.

When HA failover occurs or when the Automation is tested, an email similar to the one shown is sent to the email that you configured in the Automation.


For further reading, check out Creating user-defined Automation stitches in the FortiOS 6.0 Online Help.

Victoria Martin

Victoria Martin

Technical Writer at Fortinet
Victoria Martin works in Ottawa as part of the FortiOS technical documentation team. She graduated with a Bachelor's degree from Mount Allison University, after which she attended Humber College's book publishing program, followed by the more practical technical writing program at Algonquin College. She does need glasses but also likes wearing them, since glasses make you look smarter.
Victoria Martin

Latest posts by Victoria Martin (see all)

If you select the Medium threshold, the event trigger occurs for both medium and high level IOC threats.