In this video, I'd like to chat with you about web hooks, including what are
they, who uses them,
and how are they useful. So let's begin with a firewall, a 40-gate firewall,
and the automation
section on that 40-gate firewall. On the 40-gate firewall, if we go to security
fabric and automation,
we can set up automation stitches, which are pretty much an if-then statement.
If this happens,
for example, in an event log or some other system event happens, then do xyz.
It's an if-then statement.
And if these three 40-gate firewalls are part of the same security fabric, we
only need to configure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
only need to configure
those automation stitches here on firewall one, if it's the root, and those
will automatically be
available and propagated down to firewall two and firewall three. Now, one
question might be,
well, what does an automation stitch on a local firewall have to do with a web
hook? Well, a web
hook is how the 40 analyzer is going to call upon those automation stitches.
What we do on the
40-gate firewall is create an automation stitch with the type of web hook, and
then we can specify
the details for that automation stitch. And then those web hooks are they going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the details for that automation stitch. And then those web hooks are they going
to be available to
the 40 analyzer to call upon. So if we need to ban an IP address or take some
other action here at
the 40-gate firewalls, if those are set up as automation stitches in the web
hooks category,
the 40 analyzer can then go ahead and call upon them as part of the tasks and
actions associated
with a playbook. So to put all these pieces together, we're going to first
start at firewall one,
which is the root of these three devices security fabric. And take a look at
the current automation
stitches. And we'll also create some additional ones that will then be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
stitches. And we'll also create some additional ones that will then be
available to the 40 analyzer.
All right, so here is the 40 analyzer. Let me head over to firewall one. So
here's firewall one,
I'll log back in and click on login. First things first, I want to make sure I
'm on the right firewall.
So this is HQ firewall one, fantastic. It is running firmware version 763F at
this moment.
And if we go to security fabric and fabric connectors, so this is showing us
that we are the fabric
route. And we have three devices, those other two devices are firewall two and
firewall three at
the headquarters location for a visual representation. This is firewall one is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the headquarters location for a visual representation. This is firewall one is
firewall two and firewall
three. All right, fantastic. So for the automation part of the show locally
here on firewall one,
if we go into security fabric to automation, that's where we identify our
stitches and a stitch is
basically a combination of a trigger locally here on this 40 gate firewall. So
here's a list of our
triggers and then corresponding actions that can be taken in association with a
trigger happening.
And when you put those together, it's referred to as an automation stitch. So
let me go ahead and
clap a few that we're not going to focus on for a moment here. And the ones we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
clap a few that we're not going to focus on for a moment here. And the ones we
are going to focus
on are the incoming web hooks. So these automation stitches, because of the
category of incoming
webhook, they are available to the 40 analyzer. So the 40 analyzer based on its
playbook can reach
out and take an action, for example, like get system status or send an email
based on this
40 gate or band and IP address, which is slightly different than quarantine
because quarantine is
blocking that device at the switch and the Wi-Fi where ban IP is blocking the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
blocking that device at the switch and the Wi-Fi where ban IP is blocking the
IP address at the
40 gate itself. So if we take a look at this incoming webhook ban IP
effectively says it applies to
all 40 gates in the security fabric. And the trigger is the incoming webhook
call, which would be coming
in from the 40 analyzer. And then the action would be a ban on that IP address.
If you want to add
another action, we can click here and add yet another action. If you want them
to be done in parallel,
we could go ahead and have an additional action that's done at the same time.
So sequential simply
means you have four or five actions. They happen one after the other. If we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
means you have four or five actions. They happen one after the other. If we
want to add a delay,
we can do that as well. So I'm going to click on cancel. I'm not going to make
any changes to that.
But the key element I want to share with you here is that if we don't have
these incoming webhooks
set up on the 40 gates, it's not possible then for the 40 analyzer to make
those requests. So
whatever we want the 40 gates to be able to do, we'd sit up here and also
another benefit of having a
security fabric for our 40 gates is that once these are configured here, these
are automatically
available on the downstream 40 gates as part of that security fabric. So if we
were to go to,
for example, firewall two. So here's firewall two, I'll log in, I'll supply the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for example, firewall two. So here's firewall two, I'll log in, I'll supply the
password, we'll click on
log in. So here we are at firewall two. If we go down to security fabric, and
we take a look at
fabric connectors here showing that we have joined the fabric and that the
upstream device is effectively
firewall one at 10 dot 123 dot 0.51. And as a result of us having joined the
security fabric,
if we click on automation, it's going to give us a warning saying, you know
what, all that's
going to be done on the route, you don't need to do it here. That would apply
to stitches and triggers
and actions. We only need to configure those on the route. And if we go back to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and actions. We only need to configure those on the route. And if we go back to
firewall one
under automation, that's exactly what we've done right here with these three.
As far as the quarantine,
even though I don't have in place the four to switches and the Wi-Fi, I'm going
to right click
and set status to enable, I'm going to enable all four of those. Also, if you
want to test
that automation stitch, you can, you can, for example, select one and click
here on test automation
stitch just to verify whether or not it's functioning. And so for system status
, if we double click on
it, take a look, the trigger would be an incoming webhook call. And then the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it, take a look, the trigger would be an incoming webhook call. And then the
action would be running a
script effectively showing the system status. And if we click here, here are
the other actions that
are available. So we'll click on cancel there, cancel there. And because I just
ran it, if we
refresh this page by bouncing off and coming back to it, it should show a
quantity of five
regarding how many times that trigger has been set off. So now that we know we
have these triggers
in place, effectively stitches on the local forte gates, we can then leverage
these from forte
analyzer, which is receiving all the information from these forte gates. So to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
analyzer, which is receiving all the information from these forte gates. So to
do that, let's go
back to the forte analyzer. So back to the forte analyzer, put to this playbook
called FGT status
added to incident, the trigger is on demand, use the webhook asking for system
status,
and it's going to attach that data to an incident. So if we click on cancel
here, let's go to an
incident and actually run this playbook. So let's go back to incidents, and we
'll scroll down, we'll
just grab one here, fantastic double click on it, scroll down on the right hand
side just to confirm
what playbooks have been run, none yet. So we'll click on execute playbook, and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what playbooks have been run, none yet. So we'll click on execute playbook, and
we'll select this
one FGT status added to incident, click on run, then click on okay, and it will
actually show us
the play by play as it's doing its work. So the trigger, we manually started
that, it's now running,
it should be generating system status, which it did, and it should be attaching
that, associating
that with the incident, which it has. So now if we close this, and we close
that window, and we do a
refresh here, it should show us that that playbook has run, and also the
information has been added
to this incident. Also, if we go back to the 40 gate, where it was at five, if WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to this incident. Also, if we go back to the 40 gate, where it was at five, if
we do a refresh by
bouncing off and coming back, it's now showing seven. That's because once I did
it on camera,
and I also did it once on a different ticket, just to verify it would work. So
because it's
incrementing here, it implies that the actual playbook was successfully
executed, and that request
came in from the 40 analyzer that caused that script to run. So back to the 40
analyzer, we've
taken a look under the automation section here, we've taken a look at active
connectors, which
controls pretty much what we can work with and interact with. We've taken a big WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
controls pretty much what we can work with and interact with. We've taken a big
picture look at
playbooks, which is like a giant if then statement that's working with either
the local connector,
or with connectors to other devices. And in the next video, I'd like to walk
into some examples
of using playbooks with automated triggers based on, for example, certain
events happening or
incident being created. So you can see kind of a big picture start to finish
using playbooks for
automation with the 40 analyzer. So I'll see you in the next video in just a
moment.