Incident Investigation, Events, and Automation
Incident Investigation, Events, and Automation tests the operational layer: finding the evidence, detecting the condition, and responding consistently. In FortiAnalyzer 7.4, that means FortiView and Log View for investigation, event handlers for detection, and automation actions for response.
Investigation workflow
Start broad with FortiView to see top sources, destinations, applications, and threats for the ADOM and time window. Drill into a FortiView entry to reach filtered Log View records. In Log View, use log type and subtype, free-text search, and field filters; then pivot on a source IP, user, or threat name. Preserve the time range and ADOM, because both change the result set. For incidents, record the query, the time window, and the evidence rather than only a screenshot.
Event handlers
An event handler has a condition, a trigger, and one or more actions. Conditions use log fields; the trigger defines frequency, such as a number of matching events within a time window. Actions can include email, syslog, SNMP trap, and automation/playbook steps where configured. Event handlers evaluate new logs, so they do not retroactively fire on old data.
Automation
Automation connects a detection to a response: notify, enrich, or invoke a playbook/connector action. Automation depends on correct connectors, credentials, and permissions. Test with a low-severity condition before enabling a response that changes device configuration.
Worked example
Detect repeated failed administrator logins. Create an event handler on admin event logs where the action is login failure and the user is not a service account; set the trigger to more than 10 matches in 5 minutes; action email the SOC and send a syslog message to the SIEM. Then investigate in Log View by filtering the same event subtype and source IP for the surrounding hour. Reasoning: the handler detects the pattern, while Log View provides the evidence and context.
Traps
- Using a condition field that the parser does not populate.
- Setting a frequency window that is shorter than the log arrival interval.
- Expecting an event handler to scan historical logs.
- Enabling an automated response without testing connectors and permissions.
- Investigating in the wrong ADOM or with a time zone offset.