WEBVTT

1
00:00.000 --> 00:03.760
In this video, I'd like to chat with you about web hooks, including what are

2
00:03.760 --> 00:04.960
they, who uses them,

3
00:04.960 --> 00:08.960
and how are they useful. So let's begin with a firewall, a 40-gate firewall,

4
00:08.960 --> 00:09.840
and the automation

5
00:09.840 --> 00:13.300
section on that 40-gate firewall. On the 40-gate firewall, if we go to security

6
00:13.300 --> 00:14.320
fabric and automation,

7
00:14.320 --> 00:18.380
we can set up automation stitches, which are pretty much an if-then statement.

8
00:18.380 --> 00:19.200
If this happens,

9
00:19.200 --> 00:24.310
for example, in an event log or some other system event happens, then do xyz.

10
00:24.310 --> 00:25.760
It's an if-then statement.

11
00:25.760 --> 00:29.840
And if these three 40-gate firewalls are part of the same security fabric, we

12
00:29.840 --> 00:30.720
only need to configure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.840 --> 00:30.720
only need to configure

13
00:30.720 --> 00:34.420
those automation stitches here on firewall one, if it's the root, and those

14
00:34.420 --> 00:35.440
will automatically be

15
00:35.440 --> 00:38.590
available and propagated down to firewall two and firewall three. Now, one

16
00:38.590 --> 00:39.520
question might be,

17
00:39.520 --> 00:43.360
well, what does an automation stitch on a local firewall have to do with a web

18
00:43.360 --> 00:44.400
hook? Well, a web

19
00:44.400 --> 00:49.590
hook is how the 40 analyzer is going to call upon those automation stitches.

20
00:49.590 --> 00:50.400
What we do on the

21
00:50.400 --> 00:55.000
40-gate firewall is create an automation stitch with the type of web hook, and

22
00:55.000 --> 00:55.680
then we can specify

23
00:55.680 --> 01:00.100
the details for that automation stitch. And then those web hooks are they going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:55.680 --> 01:00.100
the details for that automation stitch. And then those web hooks are they going

24
01:00.100 --> 01:01.040
to be available to

25
01:01.040 --> 01:05.160
the 40 analyzer to call upon. So if we need to ban an IP address or take some

26
01:05.160 --> 01:06.240
other action here at

27
01:06.240 --> 01:10.080
the 40-gate firewalls, if those are set up as automation stitches in the web

28
01:10.080 --> 01:11.040
hooks category,

29
01:11.040 --> 01:15.590
the 40 analyzer can then go ahead and call upon them as part of the tasks and

30
01:15.590 --> 01:16.880
actions associated

31
01:16.880 --> 01:19.830
with a playbook. So to put all these pieces together, we're going to first

32
01:19.830 --> 01:21.120
start at firewall one,

33
01:21.120 --> 01:26.240
which is the root of these three devices security fabric. And take a look at

34
01:26.240 --> 01:27.680
the current automation

35
01:27.680 --> 01:30.750
stitches. And we'll also create some additional ones that will then be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:27.680 --> 01:30.750
stitches. And we'll also create some additional ones that will then be

36
01:30.750 --> 01:32.320
available to the 40 analyzer.

37
01:32.320 --> 01:36.080
All right, so here is the 40 analyzer. Let me head over to firewall one. So

38
01:36.080 --> 01:36.960
here's firewall one,

39
01:36.960 --> 01:41.140
I'll log back in and click on login. First things first, I want to make sure I

40
01:41.140 --> 01:42.000
'm on the right firewall.

41
01:42.000 --> 01:48.260
So this is HQ firewall one, fantastic. It is running firmware version 763F at

42
01:48.260 --> 01:49.200
this moment.

43
01:49.200 --> 01:53.360
And if we go to security fabric and fabric connectors, so this is showing us

44
01:53.360 --> 01:54.240
that we are the fabric

45
01:54.240 --> 01:58.070
route. And we have three devices, those other two devices are firewall two and

46
01:58.070 --> 01:59.040
firewall three at

47
01:59.040 --> 02:03.030
the headquarters location for a visual representation. This is firewall one is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:59.040 --> 02:03.030
the headquarters location for a visual representation. This is firewall one is

48
02:03.030 --> 02:04.400
firewall two and firewall

49
02:04.400 --> 02:08.290
three. All right, fantastic. So for the automation part of the show locally

50
02:08.290 --> 02:09.360
here on firewall one,

51
02:09.360 --> 02:13.330
if we go into security fabric to automation, that's where we identify our

52
02:13.330 --> 02:14.640
stitches and a stitch is

53
02:14.640 --> 02:18.810
basically a combination of a trigger locally here on this 40 gate firewall. So

54
02:18.810 --> 02:19.840
here's a list of our

55
02:19.840 --> 02:23.960
triggers and then corresponding actions that can be taken in association with a

56
02:23.960 --> 02:24.880
trigger happening.

57
02:24.880 --> 02:28.630
And when you put those together, it's referred to as an automation stitch. So

58
02:28.630 --> 02:29.760
let me go ahead and

59
02:29.760 --> 02:32.700
clap a few that we're not going to focus on for a moment here. And the ones we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:29.760 --> 02:32.700
clap a few that we're not going to focus on for a moment here. And the ones we

60
02:32.700 --> 02:33.440
are going to focus

61
02:33.440 --> 02:37.700
on are the incoming web hooks. So these automation stitches, because of the

62
02:37.700 --> 02:38.720
category of incoming

63
02:38.720 --> 02:43.740
webhook, they are available to the 40 analyzer. So the 40 analyzer based on its

64
02:43.740 --> 02:44.720
playbook can reach

65
02:44.720 --> 02:49.280
out and take an action, for example, like get system status or send an email

66
02:49.280 --> 02:50.160
based on this

67
02:50.160 --> 02:53.710
40 gate or band and IP address, which is slightly different than quarantine

68
02:53.710 --> 02:55.440
because quarantine is

69
02:55.440 --> 03:00.130
blocking that device at the switch and the Wi-Fi where ban IP is blocking the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:55.440 --> 03:00.130
blocking that device at the switch and the Wi-Fi where ban IP is blocking the

70
03:00.130 --> 03:01.120
IP address at the

71
03:01.120 --> 03:04.870
40 gate itself. So if we take a look at this incoming webhook ban IP

72
03:04.870 --> 03:06.480
effectively says it applies to

73
03:06.480 --> 03:10.390
all 40 gates in the security fabric. And the trigger is the incoming webhook

74
03:10.390 --> 03:11.280
call, which would be coming

75
03:11.280 --> 03:16.240
in from the 40 analyzer. And then the action would be a ban on that IP address.

76
03:16.240 --> 03:16.960
If you want to add

77
03:16.960 --> 03:20.760
another action, we can click here and add yet another action. If you want them

78
03:20.760 --> 03:22.320
to be done in parallel,

79
03:22.320 --> 03:26.340
we could go ahead and have an additional action that's done at the same time.

80
03:26.340 --> 03:27.440
So sequential simply

81
03:27.440 --> 03:30.860
means you have four or five actions. They happen one after the other. If we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:27.440 --> 03:30.860
means you have four or five actions. They happen one after the other. If we

82
03:30.860 --> 03:31.760
want to add a delay,

83
03:31.760 --> 03:34.550
we can do that as well. So I'm going to click on cancel. I'm not going to make

84
03:34.550 --> 03:35.440
any changes to that.

85
03:35.440 --> 03:38.720
But the key element I want to share with you here is that if we don't have

86
03:38.720 --> 03:40.400
these incoming webhooks

87
03:40.400 --> 03:44.200
set up on the 40 gates, it's not possible then for the 40 analyzer to make

88
03:44.200 --> 03:45.680
those requests. So

89
03:45.680 --> 03:48.920
whatever we want the 40 gates to be able to do, we'd sit up here and also

90
03:48.920 --> 03:50.480
another benefit of having a

91
03:50.480 --> 03:54.570
security fabric for our 40 gates is that once these are configured here, these

92
03:54.570 --> 03:55.360
are automatically

93
03:55.360 --> 03:59.060
available on the downstream 40 gates as part of that security fabric. So if we

94
03:59.060 --> 03:59.760
were to go to,

95
03:59.760 --> 04:04.020
for example, firewall two. So here's firewall two, I'll log in, I'll supply the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:59.760 --> 04:04.020
for example, firewall two. So here's firewall two, I'll log in, I'll supply the

96
04:04.020 --> 04:05.360
password, we'll click on

97
04:05.360 --> 04:09.480
log in. So here we are at firewall two. If we go down to security fabric, and

98
04:09.480 --> 04:10.000
we take a look at

99
04:10.000 --> 04:13.200
fabric connectors here showing that we have joined the fabric and that the

100
04:13.200 --> 04:14.880
upstream device is effectively

101
04:14.880 --> 04:19.390
firewall one at 10 dot 123 dot 0.51. And as a result of us having joined the

102
04:19.390 --> 04:20.240
security fabric,

103
04:20.240 --> 04:23.090
if we click on automation, it's going to give us a warning saying, you know

104
04:23.090 --> 04:23.760
what, all that's

105
04:23.760 --> 04:27.370
going to be done on the route, you don't need to do it here. That would apply

106
04:27.370 --> 04:29.280
to stitches and triggers

107
04:29.280 --> 04:32.740
and actions. We only need to configure those on the route. And if we go back to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:29.280 --> 04:32.740
and actions. We only need to configure those on the route. And if we go back to

108
04:32.740 --> 04:33.840
firewall one

109
04:33.840 --> 04:37.560
under automation, that's exactly what we've done right here with these three.

110
04:37.560 --> 04:38.480
As far as the quarantine,

111
04:38.480 --> 04:43.370
even though I don't have in place the four to switches and the Wi-Fi, I'm going

112
04:43.370 --> 04:44.400
to right click

113
04:44.400 --> 04:48.390
and set status to enable, I'm going to enable all four of those. Also, if you

114
04:48.390 --> 04:48.720
want to test

115
04:48.720 --> 04:52.150
that automation stitch, you can, you can, for example, select one and click

116
04:52.150 --> 04:53.440
here on test automation

117
04:53.440 --> 04:58.300
stitch just to verify whether or not it's functioning. And so for system status

118
04:58.300 --> 04:59.280
, if we double click on

119
04:59.280 --> 05:02.360
it, take a look, the trigger would be an incoming webhook call. And then the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:59.280 --> 05:02.360
it, take a look, the trigger would be an incoming webhook call. And then the

120
05:02.360 --> 05:03.600
action would be running a

121
05:03.600 --> 05:06.960
script effectively showing the system status. And if we click here, here are

122
05:06.960 --> 05:07.840
the other actions that

123
05:07.840 --> 05:11.610
are available. So we'll click on cancel there, cancel there. And because I just

124
05:11.610 --> 05:12.400
ran it, if we

125
05:12.400 --> 05:16.660
refresh this page by bouncing off and coming back to it, it should show a

126
05:16.660 --> 05:17.520
quantity of five

127
05:17.520 --> 05:21.900
regarding how many times that trigger has been set off. So now that we know we

128
05:21.900 --> 05:23.120
have these triggers

129
05:23.120 --> 05:28.010
in place, effectively stitches on the local forte gates, we can then leverage

130
05:28.010 --> 05:29.120
these from forte

131
05:29.120 --> 05:33.320
analyzer, which is receiving all the information from these forte gates. So to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:29.120 --> 05:33.320
analyzer, which is receiving all the information from these forte gates. So to

132
05:33.320 --> 05:34.000
do that, let's go

133
05:34.000 --> 05:37.710
back to the forte analyzer. So back to the forte analyzer, put to this playbook

134
05:37.710 --> 05:39.440
called FGT status

135
05:39.440 --> 05:44.100
added to incident, the trigger is on demand, use the webhook asking for system

136
05:44.100 --> 05:44.560
status,

137
05:44.560 --> 05:47.710
and it's going to attach that data to an incident. So if we click on cancel

138
05:47.710 --> 05:48.720
here, let's go to an

139
05:48.720 --> 05:52.410
incident and actually run this playbook. So let's go back to incidents, and we

140
05:52.410 --> 05:53.280
'll scroll down, we'll

141
05:53.280 --> 05:56.970
just grab one here, fantastic double click on it, scroll down on the right hand

142
05:56.970 --> 05:58.640
side just to confirm

143
05:58.640 --> 06:01.990
what playbooks have been run, none yet. So we'll click on execute playbook, and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:58.640 --> 06:01.990
what playbooks have been run, none yet. So we'll click on execute playbook, and

144
06:01.990 --> 06:02.560
we'll select this

145
06:02.560 --> 06:07.520
one FGT status added to incident, click on run, then click on okay, and it will

146
06:07.520 --> 06:08.480
actually show us

147
06:08.480 --> 06:12.410
the play by play as it's doing its work. So the trigger, we manually started

148
06:12.410 --> 06:13.840
that, it's now running,

149
06:13.840 --> 06:17.180
it should be generating system status, which it did, and it should be attaching

150
06:17.180 --> 06:17.760
that, associating

151
06:17.760 --> 06:21.600
that with the incident, which it has. So now if we close this, and we close

152
06:21.600 --> 06:22.800
that window, and we do a

153
06:22.800 --> 06:26.020
refresh here, it should show us that that playbook has run, and also the

154
06:26.020 --> 06:27.760
information has been added

155
06:27.760 --> 06:31.720
to this incident. Also, if we go back to the 40 gate, where it was at five, if
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
06:27.760 --> 06:31.720
to this incident. Also, if we go back to the 40 gate, where it was at five, if

156
06:31.720 --> 06:32.720
we do a refresh by

157
06:32.720 --> 06:38.350
bouncing off and coming back, it's now showing seven. That's because once I did

158
06:38.350 --> 06:39.280
it on camera,

159
06:39.280 --> 06:43.130
and I also did it once on a different ticket, just to verify it would work. So

160
06:43.130 --> 06:43.520
because it's

161
06:43.520 --> 06:47.120
incrementing here, it implies that the actual playbook was successfully

162
06:47.120 --> 06:48.720
executed, and that request

163
06:48.720 --> 06:52.520
came in from the 40 analyzer that caused that script to run. So back to the 40

164
06:52.520 --> 06:53.440
analyzer, we've

165
06:53.440 --> 06:57.050
taken a look under the automation section here, we've taken a look at active

166
06:57.050 --> 06:58.080
connectors, which

167
06:58.080 --> 07:01.220
controls pretty much what we can work with and interact with. We've taken a big
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
06:58.080 --> 07:01.220
controls pretty much what we can work with and interact with. We've taken a big

168
07:01.220 --> 07:01.920
picture look at

169
07:01.920 --> 07:05.350
playbooks, which is like a giant if then statement that's working with either

170
07:05.350 --> 07:06.720
the local connector,

171
07:06.720 --> 07:09.920
or with connectors to other devices. And in the next video, I'd like to walk

172
07:09.920 --> 07:10.960
into some examples

173
07:10.960 --> 07:14.450
of using playbooks with automated triggers based on, for example, certain

174
07:14.450 --> 07:15.520
events happening or

175
07:15.520 --> 07:19.000
incident being created. So you can see kind of a big picture start to finish

176
07:19.000 --> 07:19.840
using playbooks for

177
07:19.840 --> 07:24.030
automation with the 40 analyzer. So I'll see you in the next video in just a

178
07:24.030 --> 07:24.800
moment.