IBM QRadar SOAR

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

When the playbooks input script gets the value from an artifact of type "IP Address" it will return a string value.

Is the IP address that you are using as input when running this playbook present on your Fortigate server? If the IP address is not present on your Fortigate server, then running this playbook will result in an error.

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

Hello Richard,

Thank you for your response. I have used another playbook "Fortigate Create address" to create an address with I(P address/subnet mask). eg 10.10.10.8/32.

After confirming that this address exists on the Fortigate, I created an Artifact (type IP address) with this value "10.10.10.8", and I got the same error.


Note the artifact type ip address does not accept ip/subnet mask.eg 10.10.10.8/32
Regards,

When the playbooks input script gets the value from an artifact of type "IP Address" it will return a string value.

Is the IP address that you are using as input when running this playbook present on your Fortigate server? If the IP address is not present on your Fortigate server, then running this playbook will result in an error.

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

Hello expert,

I will appreciate any help here.

Regards,

Hello Richard,

Thank you for your response. I have used another playbook "Fortigate Create address" to create an address with I(P address/subnet mask). eg 10.10.10.8/32.

After confirming that this address exists on the Fortigate, I created an Artifact (type IP address) with this value "10.10.10.8", and I got the same error.


Note the artifact type ip address does not accept ip/subnet mask.eg 10.10.10.8/32
Regards,

When the playbooks input script gets the value from an artifact of type "IP Address" it will return a string value.

Is the IP address that you are using as input when running this playbook present on your Fortigate server? If the IP address is not present on your Fortigate server, then running this playbook will result in an error.

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

Hello, could you please try creating a new IP address on Fortigate that does not have a subnet mask and then run the playbook using that IP address.

Hello expert,

I will appreciate any help here.

Regards,

Hello Richard,

Thank you for your response. I have used another playbook "Fortigate Create address" to create an address with I(P address/subnet mask). eg 10.10.10.8/32.

After confirming that this address exists on the Fortigate, I created an Artifact (type IP address) with this value "10.10.10.8", and I got the same error.


Note the artifact type ip address does not accept ip/subnet mask.eg 10.10.10.8/32
Regards,

When the playbooks input script gets the value from an artifact of type "IP Address" it will return a string value.

Is the IP address that you are using as input when running this playbook present on your Fortigate server? If the IP address is not present on your Fortigate server, then running this playbook will result in an error.

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

Hello Richard,

Thank you for your response. I dont think it makes sense to manually create an IP address on fortigate before initiating this playbook. Because if an incident occurs that contains a malicious IP address, would a soc analyst be telling the fortigate admin to create the IP address before they can initiate the playbook "Fortigate Ban IPs"

Hello, could you please try creating a new IP address on Fortigate that does not have a subnet mask and then run the playbook using that IP address.

Hello expert,

I will appreciate any help here.

Regards,

Hello Richard,

Thank you for your response. I have used another playbook "Fortigate Create address" to create an address with I(P address/subnet mask). eg 10.10.10.8/32.

After confirming that this address exists on the Fortigate, I created an Artifact (type IP address) with this value "10.10.10.8", and I got the same error.


Note the artifact type ip address does not accept ip/subnet mask.eg 10.10.10.8/32
Regards,

When the playbooks input script gets the value from an artifact of type "IP Address" it will return a string value.

Is the IP address that you are using as input when running this playbook present on your Fortigate server? If the IP address is not present on your Fortigate server, then running this playbook will result in an error.

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

Error 403 means Forbidden (you can read more about the error here). Which suggests that there might be something wrong with your config file or other settings. Basically the query isn't allowed to make changes on the firewall. 

------------------------------
Maria Czapkowska

Original Message:
Sent: Fri February 23, 2024 02:09 AM
From: benlinux
Subject: Fortigate Ban IP Playbook

Hello experts,

I have integrated my Fortigate Firewall to QRadar SOAR successfully. I have also tested few playbooks and they work fine. However,  the Fortigate Ban IP is not working.

I tested using the following approach:

I created an artifact of type IP address, and triggered the playbook "Fortigate Ban IP". The Playbook completes without any error, but gives the below message in the Note tab

FortiGate failed with reason: "Status Code: 403, {'http_method': 'POST', 'status': 'error', 'http_status': 403, 'vdom': 'root', 'path': 'user', 'name': 'banned', 'action': 'add_users', 'serial': '****', 'version': v***, 'build': ***}"

I have a concern here, reviewing the playbook "Fortigate Ban IPs", it shows that the Fortigate_addresses (as shown in the screen shot) should be of text artifact type, but when you create a "String" artifact type , the Playbook "Fortigate Ban IPs" is not available to be selected.

I will appreciate if someone can help me on how to test the "Fortigate Ban IPs" playbook.

Regards,

------------------------------
benlinux
------------------------------