configuration-changed-by-admin-with-changes-email-alert.adoc

Send alert on Fortigate configuration changed by administrator with details

Task: Each time any configuration is being changed send an email that will also contain the detailed description of what changes were made.

Note	This stitch will fire on every change made by the administrator and in real-time, each time the admin clicks on Apply in GUI, or enters end/next in CLI. In GUI, the log ids are 44546 and 44547 and called Attribute configured and Object attribute configured.

• Trigger:

config sys automation-trigger
    edit "ConfigChanges_trigger"
        set event-type event-log
        set logid 44546 44547
    next
end

• Action - email alert:

config sys automation-action
    edit "ConfigChanged_email"
        set action-type email
        set email-to "admin@yurisk.info"
        set email-from "fgt@yurisk.info"
        set email-subject "%%log.logdesc%%"
    next
end

• Stitch:

config system automation-stitch
    edit "ConfigChangedwithChanges"
        set trigger "ConfigChanges_trigger"
        config actions
            edit 1
                set action "ConfigChanged_email"
                set required enable
            next
        end
    next
end