WEBVTT

1
00:00.000 --> 00:02.960
In this video, we're going to take a big picture look at the wonderful world of

2
00:02.960 --> 00:04.720
playbooks on the 40 analyzer.

3
00:04.720 --> 00:08.640
And another way of thinking about playbooks is the concept of automation.

4
00:08.640 --> 00:11.920
And the concept of automation is not new to the 40 gate firewall.

5
00:11.920 --> 00:14.320
It's also not new to the 40 analyzer.

6
00:14.320 --> 00:17.760
It's basically saying, if then, if this happens, then do that.

7
00:17.760 --> 00:18.640
And then the other thing.

8
00:18.640 --> 00:22.080
And so we can have automation set up on our 40 gate firewalls.

9
00:22.080 --> 00:25.600
And if we put these three devices in the same security fabric,

10
00:25.600 --> 00:28.320
then the automation that we create here on the firewall one,

11
00:28.320 --> 00:31.350
if that's the root of the security fabric, those automation elements get
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.320 --> 00:31.350
if that's the root of the security fabric, those automation elements get

12
00:31.350 --> 00:32.160
replicated

13
00:32.160 --> 00:34.880
to the other members in that same security fabric.

14
00:34.880 --> 00:38.480
And on the 40 gate firewall, they're often referred to as a stitch looking for

15
00:38.480 --> 00:39.120
some event.

16
00:39.120 --> 00:42.320
And then based on that event occurring, having a corresponding action.

17
00:42.320 --> 00:44.000
So we're like an if then statement.

18
00:44.000 --> 00:45.520
If this happens, then do that.

19
00:45.520 --> 00:49.280
So let me clean this up just a little bit and let's chat about automation,

20
00:49.280 --> 00:52.960
a.k.a. playbooks in conjunction with the 40 analyzer here.

21
00:52.960 --> 00:55.760
And in our topology, we'll be using some 40 gates as well.

22
00:55.760 --> 00:58.400
So only 40 analyzer will put Faz for short there.

23
00:58.400 --> 01:02.000
The first part of automation is going to evolve a trigger,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:58.400 --> 01:02.000
The first part of automation is going to evolve a trigger,

24
01:02.000 --> 01:04.160
something to kick off that automation.

25
01:04.160 --> 01:07.840
And if we boil it down, there are four types of triggers that we can set up.

26
01:07.840 --> 01:10.960
We can have a trigger that's based on some event happening.

27
01:10.960 --> 01:14.080
We can have a trigger that goes off when an incident is created.

28
01:14.080 --> 01:17.520
And with each of these triggers, we can specify exactly what we're looking for

29
01:17.520 --> 01:18.880
that would act as a trigger.

30
01:18.880 --> 01:20.480
We can have triggers that are scheduled.

31
01:20.480 --> 01:24.820
And that scheduling can be based on a date or time or interval or recurring

32
01:24.820 --> 01:25.200
time.

33
01:25.200 --> 01:28.040
And with a scheduled trigger, it basically means it's going to run on the

34
01:28.040 --> 01:28.960
configured schedule.

35
01:28.960 --> 01:32.480
So you can identify the start time, the end time, the interval type,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.960 --> 01:32.480
So you can identify the start time, the end time, the interval type,

36
01:32.480 --> 01:34.720
how frequently it should run and so forth.

37
01:34.720 --> 01:37.360
And then the last one is called on demand.

38
01:37.360 --> 01:40.480
And with that type of a trigger, it's waiting for an administrator or somebody

39
01:40.480 --> 01:44.370
who has access rights into the system to actually physically set off the

40
01:44.370 --> 01:44.640
trigger

41
01:44.640 --> 01:46.320
and say, please run this playbook.

42
01:46.320 --> 01:50.000
So all these triggers are going to lead to the running of a playbook.

43
01:50.000 --> 01:52.960
And the triggers are included as part of that playbook.

44
01:52.960 --> 01:57.600
Now, another key component of a playbook is based on a trigger being invoked.

45
01:57.600 --> 02:01.120
What kind of tasks can we have the system automate?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:57.600 --> 02:01.120
What kind of tasks can we have the system automate?

46
02:01.120 --> 02:06.000
And that's going to depend a lot based on what the 40 analyzer has access to.

47
02:06.000 --> 02:09.540
So we're going to what tasks can be accomplished once a trigger is identified

48
02:09.540 --> 02:10.400
and set off.

49
02:10.400 --> 02:13.280
Depends a lot on what the 40 analyzer has access to.

50
02:13.280 --> 02:17.440
So here under tasks, let me go ahead and say that depends on which connectors

51
02:17.440 --> 02:17.840
we have.

52
02:17.840 --> 02:18.800
And the question, make them up.

53
02:18.800 --> 02:20.240
What do you mean what type of connectors?

54
02:20.240 --> 02:24.720
Well, the 40 analyzer itself has a built in connector to itself.

55
02:24.720 --> 02:25.760
It's called local.

56
02:25.760 --> 02:27.760
So let me make a little list over here for connectors.

57
02:27.760 --> 02:32.080
So one of those connectors is called the local and it's on the 40 analyzer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:27.760 --> 02:32.080
So one of those connectors is called the local and it's on the 40 analyzer.

58
02:32.080 --> 02:33.360
So it's referring to itself.

59
02:33.360 --> 02:37.440
Another connector, if you have 40 gates that are reporting to the 40 analyzer,

60
02:37.440 --> 02:40.800
another connector would be 40OS, which is representing the operating

61
02:40.800 --> 02:42.560
system running on these 40 gate firewalls.

62
02:42.560 --> 02:45.760
Also, if you have a license for 40 analyzer, it has access to ForteGuard.

63
02:45.760 --> 02:47.840
So that's another connector it has to use.

64
02:47.840 --> 02:50.640
And if you have other Fortinet products that are licensed, you could also have

65
02:50.640 --> 02:51.520
a 40 analyzer

66
02:51.520 --> 02:54.720
connect to those, for example, things like or 40 sandbox.

67
02:54.720 --> 02:57.200
In fact, I'll just go ahead and put 40x.

68
02:57.200 --> 03:01.440
But the X is a variable for one of the dozens of Fortinet products
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:57.200 --> 03:01.440
But the X is a variable for one of the dozens of Fortinet products

69
03:01.440 --> 03:03.600
that the 40 analyzer can interact with.

70
03:03.600 --> 03:06.240
There's also some connectors to external resources.

71
03:06.240 --> 03:09.040
For example, there's a connector we're going to have to virus total.

72
03:09.040 --> 03:12.240
So the connector to virus total, we can have a playbook that is leveraging

73
03:12.240 --> 03:12.800
virus total

74
03:12.800 --> 03:16.480
to find out the reputation, for example, of an IP address or domain

75
03:16.480 --> 03:18.640
by querying in the background, virus total.

76
03:18.640 --> 03:23.140
We could also integrate with ServiceNow and Slack and a host of Microsoft

77
03:23.140 --> 03:23.520
products,

78
03:23.520 --> 03:25.280
for example, like Microsoft Teams.

79
03:25.280 --> 03:29.540
So we're going to get a little task is going to depend a lot on which device we

80
03:29.540 --> 03:30.080
're interacting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:29.540 --> 03:30.080
're interacting

81
03:30.080 --> 03:33.840
with, which is based on which connectors we have set up on the 40 analyzer.

82
03:33.840 --> 03:35.360
And some of these are going to be there by default.

83
03:35.360 --> 03:38.560
For example, the local connector, which is the 40 analyzer itself,

84
03:38.560 --> 03:40.240
that's going to be there by default.

85
03:40.240 --> 03:43.600
If we have 40 gate firewalls that are reporting in and sending our logs over to

86
03:43.600 --> 03:44.800
40 analyzer,

87
03:44.800 --> 03:46.080
that'll be there by default.

88
03:46.080 --> 03:49.120
And if we have a license for 40 analyzer that we're using, we'll have the

89
03:49.120 --> 03:50.720
ForteGuard connector as well.

90
03:50.720 --> 03:54.080
And as far as adding some of these others, for example, virus total, you can go

91
03:54.080 --> 03:54.800
out and get a

92
03:54.800 --> 03:59.600
free account at virus total and then get the API key and plug that into 40

93
03:59.600 --> 04:00.240
analyzer
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:59.600 --> 04:00.240
analyzer

94
04:00.240 --> 04:02.240
for that connector out to virus total.

95
04:02.240 --> 04:05.760
And so as we go through this set of videos, we're providing a few examples

96
04:05.760 --> 04:10.240
of each of these components and also walking through some examples of playbooks

97
04:10.240 --> 04:10.240
,

98
04:10.240 --> 04:14.480
which involve triggers and tasks based on the connectors to perform a specific

99
04:14.480 --> 04:14.880
action.

100
04:14.880 --> 04:18.320
And that way we'll have the opportunity to not only understand these components

101
04:18.320 --> 04:18.320
,

102
04:18.320 --> 04:20.240
but also to see them in action.

103
04:20.240 --> 04:23.680
So I'll see you in the next video as we take a closer look at some of the

104
04:23.680 --> 04:24.240
connectors that we

105
04:24.240 --> 04:29.040
have by default and also adding some additional connectors to our 40 analyzer.