In this video, we're going to take a big picture look at the wonderful world of
playbooks on the 40 analyzer.
And another way of thinking about playbooks is the concept of automation.
And the concept of automation is not new to the 40 gate firewall.
It's also not new to the 40 analyzer.
It's basically saying, if then, if this happens, then do that.
And then the other thing.
And so we can have automation set up on our 40 gate firewalls.
And if we put these three devices in the same security fabric,
then the automation that we create here on the firewall one,
if that's the root of the security fabric, those automation elements get WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if that's the root of the security fabric, those automation elements get
replicated
to the other members in that same security fabric.
And on the 40 gate firewall, they're often referred to as a stitch looking for
some event.
And then based on that event occurring, having a corresponding action.
So we're like an if then statement.
If this happens, then do that.
So let me clean this up just a little bit and let's chat about automation,
a.k.a. playbooks in conjunction with the 40 analyzer here.
And in our topology, we'll be using some 40 gates as well.
So only 40 analyzer will put Faz for short there.
The first part of automation is going to evolve a trigger, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The first part of automation is going to evolve a trigger,
something to kick off that automation.
And if we boil it down, there are four types of triggers that we can set up.
We can have a trigger that's based on some event happening.
We can have a trigger that goes off when an incident is created.
And with each of these triggers, we can specify exactly what we're looking for
that would act as a trigger.
We can have triggers that are scheduled.
And that scheduling can be based on a date or time or interval or recurring
time.
And with a scheduled trigger, it basically means it's going to run on the
configured schedule.
So you can identify the start time, the end time, the interval type, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So you can identify the start time, the end time, the interval type,
how frequently it should run and so forth.
And then the last one is called on demand.
And with that type of a trigger, it's waiting for an administrator or somebody
who has access rights into the system to actually physically set off the
trigger
and say, please run this playbook.
So all these triggers are going to lead to the running of a playbook.
And the triggers are included as part of that playbook.
Now, another key component of a playbook is based on a trigger being invoked.
What kind of tasks can we have the system automate? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What kind of tasks can we have the system automate?
And that's going to depend a lot based on what the 40 analyzer has access to.
So we're going to what tasks can be accomplished once a trigger is identified
and set off.
Depends a lot on what the 40 analyzer has access to.
So here under tasks, let me go ahead and say that depends on which connectors
we have.
And the question, make them up.
What do you mean what type of connectors?
Well, the 40 analyzer itself has a built in connector to itself.
It's called local.
So let me make a little list over here for connectors.
So one of those connectors is called the local and it's on the 40 analyzer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So one of those connectors is called the local and it's on the 40 analyzer.
So it's referring to itself.
Another connector, if you have 40 gates that are reporting to the 40 analyzer,
another connector would be 40OS, which is representing the operating
system running on these 40 gate firewalls.
Also, if you have a license for 40 analyzer, it has access to ForteGuard.
So that's another connector it has to use.
And if you have other Fortinet products that are licensed, you could also have
a 40 analyzer
connect to those, for example, things like or 40 sandbox.
In fact, I'll just go ahead and put 40x.
But the X is a variable for one of the dozens of Fortinet products WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But the X is a variable for one of the dozens of Fortinet products
that the 40 analyzer can interact with.
There's also some connectors to external resources.
For example, there's a connector we're going to have to virus total.
So the connector to virus total, we can have a playbook that is leveraging
virus total
to find out the reputation, for example, of an IP address or domain
by querying in the background, virus total.
We could also integrate with ServiceNow and Slack and a host of Microsoft
products,
for example, like Microsoft Teams.
So we're going to get a little task is going to depend a lot on which device we
're interacting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
're interacting
with, which is based on which connectors we have set up on the 40 analyzer.
And some of these are going to be there by default.
For example, the local connector, which is the 40 analyzer itself,
that's going to be there by default.
If we have 40 gate firewalls that are reporting in and sending our logs over to
40 analyzer,
that'll be there by default.
And if we have a license for 40 analyzer that we're using, we'll have the
ForteGuard connector as well.
And as far as adding some of these others, for example, virus total, you can go
out and get a
free account at virus total and then get the API key and plug that into 40
analyzer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
analyzer
for that connector out to virus total.
And so as we go through this set of videos, we're providing a few examples
of each of these components and also walking through some examples of playbooks
,
which involve triggers and tasks based on the connectors to perform a specific
action.
And that way we'll have the opportunity to not only understand these components
,
but also to see them in action.
So I'll see you in the next video as we take a closer look at some of the
connectors that we
have by default and also adding some additional connectors to our 40 analyzer.