fmgd_log_threatweight – Configure threat weight settings.

Added in version 1.1.0.

Synopsis

  • This module is able to configure a FortiManager device.

  • Examples include all parameters and values need to be adjusted to data sources before usage.

  • Tested with FortiManager v7.x.

Requirements

The below requirements are needed on the host that executes this module.

  • ansible-core>=2.16.0

FortiManager Version Compatibility

Supported Version Ranges: v7.4.8 -> v7.4.10, v7.6.4 -> latest

Parameters

  • access_token -The token to access FortiManager without using username and password. type: str required: false
  • bypass_validation - Only set to True when module schema diffs with FortiManager API structure, module continues to execute without validating parameters. type: bool required: false default: False
  • enable_log - Enable/Disable logging for task. type: bool required: false default: False
  • forticloud_access_token - Access token of forticloud managed API users, this option is available with FortiManager later than 6.4.0. type: str required: false
  • proposed_method - The overridden method for the underlying Json RPC request. type: str required: false choices: set, update, add
  • rc_succeeded - The rc codes list with which the conditions to succeed will be overriden. type: list required: false
  • rc_failed - The rc codes list with which the conditions to fail will be overriden. type: list required: false
  • workspace_locking_adom - Acquire the workspace lock if FortiManager is running in workspace mode. type: str required: false choices: global, custom adom including root
  • workspace_locking_timeout - The maximum time in seconds to wait for other users to release workspace lock. type: integer required: false default: 300
  • device - The parameter in requested url type: str required: true
  • vdom - The parameter in requested url type: str required: true
  • log_threatweight - Configure threat weight settings. type: dict
    • application Application. type: list more...
      • category Application category. type: list more...
      • id Entry id. type: int more...
      • level Threat weight score for application events. type: str choices: [disable, low, medium, high, critical] more...
    • blocked_connection (Alias name: blocked-connection) Threat weight score for blocked connections. type: str choices: [disable, low, medium, high, critical] more...
    • botnet_connection_detected (Alias name: botnet-connection-detected) Threat weight score for detected botnet connections. type: str choices: [disable, low, medium, high, critical] more...
    • failed_connection (Alias name: failed-connection) Threat weight score for failed connections. type: str choices: [disable, low, medium, high, critical] more...
    • geolocation Geolocation. type: list more...
      • country Country code. type: list more...
      • id Entry id. type: int more...
      • level Threat weight score for geolocation-based events. type: str choices: [disable, low, medium, high, critical] more...
    • ips Ips. type: dict more...
      • critical_severity (Alias name: critical-severity) Threat weight score for ips critical severity events. type: str choices: [disable, low, medium, high, critical] more...
      • high_severity (Alias name: high-severity) Threat weight score for ips high severity events. type: str choices: [disable, low, medium, high, critical] more...
      • info_severity (Alias name: info-severity) Threat weight score for ips info severity events. type: str choices: [disable, low, medium, high, critical] more...
      • low_severity (Alias name: low-severity) Threat weight score for ips low severity events. type: str choices: [disable, low, medium, high, critical] more...
      • medium_severity (Alias name: medium-severity) Threat weight score for ips medium severity events. type: str choices: [disable, low, medium, high, critical] more...
    • level Level. type: dict more...
      • critical Critical level score value (1 - 100). type: int more...
      • high High level score value (1 - 100). type: int more...
      • low Low level score value (1 - 100). type: int more...
      • medium Medium level score value (1 - 100). type: int more...
    • malware Malware. type: dict more...
      • command_blocked (Alias name: command-blocked) Threat weight score for blocked command detected. type: str choices: [disable, low, medium, high, critical] more...
      • content_disarm (Alias name: content-disarm) Threat weight score for virus (content disarm) detected. type: str choices: [disable, low, medium, high, critical] more...
      • ems_threat_feed (Alias name: ems-threat-feed) Threat weight score for virus (ems threat feed) detected. type: str choices: [disable, low, medium, high, critical] more...
      • file_blocked (Alias name: file-blocked) Threat weight score for blocked file detected. type: str choices: [disable, low, medium, high, critical] more...
      • fortindr Threat weight score for fortindr-detected virus. type: str choices: [disable, low, medium, high, critical] more...
      • fortisandbox Threat weight score for fortisandbox-detected virus. type: str choices: [disable, low, medium, high, critical] more...
      • fsa_high_risk (Alias name: fsa-high-risk) Threat weight score for fortisandbox high risk malware detected. type: str choices: [disable, low, medium, high, critical] more...
      • fsa_malicious (Alias name: fsa-malicious) Threat weight score for fortisandbox malicious malware detected. type: str choices: [disable, low, medium, high, critical] more...
      • fsa_medium_risk (Alias name: fsa-medium-risk) Threat weight score for fortisandbox medium risk malware detected. type: str choices: [disable, low, medium, high, critical] more...
      • malware_list (Alias name: malware-list) Threat weight score for virus (malware list) detected. type: str choices: [disable, low, medium, high, critical] more...
      • mimefragmented Threat weight score for mimefragmented detected. type: str choices: [disable, low, medium, high, critical] more...
      • oversized Threat weight score for oversized file detected. type: str choices: [disable, low, medium, high, critical] more...
      • switch_proto (Alias name: switch-proto) Threat weight score for switch proto detected. type: str choices: [disable, low, medium, high, critical] more...
      • virus_file_type_executable (Alias name: virus-file-type-executable) Threat weight score for virus (file type executable) detected. type: str choices: [disable, low, medium, high, critical] more...
      • virus_infected (Alias name: virus-infected) Threat weight score for virus (infected) detected. type: str choices: [disable, low, medium, high, critical] more...
      • virus_outbreak_prevention (Alias name: virus-outbreak-prevention) Threat weight score for virus (outbreak prevention) event. type: str choices: [disable, low, medium, high, critical] more...
      • virus_scan_error (Alias name: virus-scan-error) Threat weight score for virus (scan error) detected. type: str choices: [disable, low, medium, high, critical] more...
      • inline_block (Alias name: inline-block) Threat weight score for malware detected by inline block. type: str choices: [disable, low, medium, high, critical] more...
      • fortiai Threat weight score for fortiai-detected virus. type: str choices: [disable, low, medium, high, critical] more...
    • status Enable/disable the threat weight feature. type: str choices: [disable, enable] more...
    • url_block_detected (Alias name: url-block-detected) Threat weight score for url blocking. type: str choices: [disable, low, medium, high, critical] more...
    • web Web. type: list more...
      • category Threat weight score for web category filtering matches. type: list more...
      • id Entry id. type: int more...
      • level Threat weight score for web category filtering matches. type: str choices: [disable, low, medium, high, critical] more...
    • malware_detected (Alias name: malware-detected) Threat weight score for detected malware. type: str choices: [disable, low, medium, high, critical] more...

Notes

Note

  • Running in workspace locking mode is supported in this FortiManager module, the top level parameters workspace_locking_adom and workspace_locking_timeout help do the work.

  • To create or update an object, use state: present directive.

  • To delete an object, use state: absent directive

  • Normally, running one module can fail when a non-zero rc is returned. you can also override the conditions to fail or succeed with parameters rc_failed and rc_succeeded

Examples

- name: Example playbook (generated based on argument schema)
  hosts: fortimanagers
  connection: httpapi
  gather_facts: false
  vars:
    ansible_httpapi_use_ssl: true
    ansible_httpapi_validate_certs: false
    ansible_httpapi_port: 443
  tasks:
    - name: Configure threat weight settings.
      fortinet.fmgdevice.fmgd_log_threatweight:
        # bypass_validation: false
        # workspace_locking_adom: <global or your adom name>
        # workspace_locking_timeout: 300
        # rc_succeeded: [0, -2, -3, ...]
        # rc_failed: [-2, -3, ...]
        device: <your own value>
        vdom: <your own value>
        log_threatweight:
          # application:
          #   - category: <list or string>
          #     id: <integer>
          #     level: <value in [disable, low, medium, ...]>
          # blocked_connection: <value in [disable, low, medium, ...]>
          # botnet_connection_detected: <value in [disable, low, medium, ...]>
          # failed_connection: <value in [disable, low, medium, ...]>
          # geolocation:
          #   - country: <list or string>
          #     id: <integer>
          #     level: <value in [disable, low, medium, ...]>
          # ips:
          #   critical_severity: <value in [disable, low, medium, ...]>
          #   high_severity: <value in [disable, low, medium, ...]>
          #   info_severity: <value in [disable, low, medium, ...]>
          #   low_severity: <value in [disable, low, medium, ...]>
          #   medium_severity: <value in [disable, low, medium, ...]>
          # level:
          #   critical: <integer>
          #   high: <integer>
          #   low: <integer>
          #   medium: <integer>
          # malware:
          #   command_blocked: <value in [disable, low, medium, ...]>
          #   content_disarm: <value in [disable, low, medium, ...]>
          #   ems_threat_feed: <value in [disable, low, medium, ...]>
          #   file_blocked: <value in [disable, low, medium, ...]>
          #   fortindr: <value in [disable, low, medium, ...]>
          #   fortisandbox: <value in [disable, low, medium, ...]>
          #   fsa_high_risk: <value in [disable, low, medium, ...]>
          #   fsa_malicious: <value in [disable, low, medium, ...]>
          #   fsa_medium_risk: <value in [disable, low, medium, ...]>
          #   malware_list: <value in [disable, low, medium, ...]>
          #   mimefragmented: <value in [disable, low, medium, ...]>
          #   oversized: <value in [disable, low, medium, ...]>
          #   switch_proto: <value in [disable, low, medium, ...]>
          #   virus_file_type_executable: <value in [disable, low, medium, ...]>
          #   virus_infected: <value in [disable, low, medium, ...]>
          #   virus_outbreak_prevention: <value in [disable, low, medium, ...]>
          #   virus_scan_error: <value in [disable, low, medium, ...]>
          #   inline_block: <value in [disable, low, medium, ...]>
          #   fortiai: <value in [disable, low, medium, ...]>
          # status: <value in [disable, enable]>
          # url_block_detected: <value in [disable, low, medium, ...]>
          # web:
          #   - category: <list or string>
          #     id: <integer>
          #     level: <value in [disable, low, medium, ...]>
          # malware_detected: <value in [disable, low, medium, ...]>

Return Values

Common return values are documented: https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values, the following are the fields unique to this module:

  • meta - The result of the request.returned: always type: dict
    • request_url - The full url requested. returned: always type: str sample: /sys/login/user
    • response_code - The status of api request. returned: always type: int sample: 0
    • response_data - The data body of the api response. returned: optional type: list or dict
    • response_message - The descriptive message of the api response. returned: always type: str sample: OK
    • system_information - The information of the target system. returned: always type: dict
  • rc - The status the request. returned: always type: int sample: 0
  • version_check_warning - Warning if the parameters used in the playbook are not supported by the current FortiManager version. returned: if at least one parameter not supported by the current FortiManager version type: list

Status

  • This module is not guaranteed to have a backwards compatible interface.

Authors

  • Xinwei Du (@dux-fortinet)

  • Xing Li (@lix-fortinet)

  • Jie Xue (@JieX19)

  • Link Zheng (@chillancezen)

  • Frank Shen (@fshen01)

  • Hongbin Lu (@fgtdev-hblu)