AlienApp for Fortinet FortiGate Actions

As USM Anywhere surfaces events, alarms, and vulnerabilities, you can use FortiGate actions to respond to the events in your environment. Rather than manually adding addresses in the FortiGate user interface (UI) and entering the relevant information, you can use the AlienApp for Fortinet FortiGate response actions to automatically manage your FortiGate firewall using information from your USM Anywhere environment. The table below shows the actions.

Actions for the AlienApp for Fortinet FortiGate
Action Description

Add Source Address to Address Group

Run this action to add the source address to a group in your FortiGate environment. If the group doesn't exist in FortiGate, it will be created by the action from USM Anywhere
Add Destination Address to Address Group Run this action to add the destination address to a group in your FortiGate environment. If the group doesn't exist in FortiGate, it will be created by the action from USM Anywhere
Add to Custom Category Run this action to add the source address to a group in your FortiGate environment
Add to Custom Category Run this action to include the source address, destination address, or both to a custom group in your FortiGate environment
Add to Custom Category Run this action to assign an asset, object, or item to a custom category
Add Address to Address Group Run this action to add an IP address to a predefined address group
Add Address to Address Group Using Rule Run this action to add IP address to a predefined address group based on a specified rule
Add Address to Static URL Filter Run this action to assign an address or URL to a predefined static URL filter
Add Address to Static URL Filter Using Rule Run this action to assign an address or URL to a predefined static URL filter using a specified rule

Note: Before launching a FortiGate response action or creating a FortiGate response action rule, the AlienApp for Fortinet FortiGate must be enabled and connected to your FortiGate instance. See Configuring the AlienApp for Fortinet FortiGate for more information.

To view information about these actions in USM Anywhere

  1. In USM Anywhere, go to Data Sources > AlienApps.
  2. Click the Available Apps tab.
  3. Search for the AlienApp, and then click the tile.
  4. Click the Actions tab to display information for the supported actions.
  5. Click the History tab to display information about the executed orchestration actions.

Launch Actions from USM Anywhere

When you review the information in the Alarm Details, Event Details, or Vulnerability Details, you can easily launch an action to send a request to your connected FortiGate instance to add source or destination IP address information to an existing FortiGate group. If you want to apply an action to similar events that occur in the future, you can also create orchestration rules directly from an action applied to an alarm, event, or vulnerability.

To launch a FortiGate response action for an alarm, event, or vulnerability

  1. Go to Activity > Alarms, Activity > Events, or Environment > Vulnerabilities.
  2. Click the alarm, event, or vulnerability to open the details.
  3. Click Select Action.

  4. In the Select Action dialog box, select Run FortiGate Action.

  5. Select the app action and fill out the fields that are populated in the window.

  6. Click Run.

    After USM Anywhere initiates the action for an alarm or event, it displays a confirmation dialog box.

    If you want to create a rule to apply the action to similar items that occur in the future, click Create rule for similar alarms or Create rule for similar events and define the new rule. If not, click OK.