How to use a Logic app or Fuction app to apply a powershell script to connect into a Fortigate firewall and apply a IP address to a blocked list.

Question

I am using Azure Sentinel with the Fortigate firewall connector to receive CEF logs and filter whenever our firewall detects a failed "SSL-VPN-Login".

I created an Antilytic rule that runs the KQL query,
//Query Failed VPN Logins
CommonSecurityLog
| where DeviceAction has "ssl-login-fail"

And I see the CEF logs.

At this point I am using Microsoft Sentinel | Automation and I created a "Playbook with Alert trigger" using the Connector "Microsoft Sentinel Alert (Preview)" to send an email with some details from the CEF log including,
Destination IP
Destination Host Name
Time Generated

What I'd like it to do before it sends the email, is to use Powershell Operations to apply a script or invoke a SSH command to log into the Fortigate Firewall and add the Destination IP to our blocked IPs list in the Fortigate Firewall.

I cannot find any Powershell operations or SSH operations that will allow me to do this.

Any help on this would be appreciated,

Thanks.

Answer 1

Hi @Christopher Gray ,

Welcome to Microsoft Q&A Platform. Thank you for the question.

You can use Azure automation and create a Runbook and then run the created Azure Automation from Logicapps.

Kindly refer the below threads to get some help,

• https://learn.microsoft.com/en-us/answers/questions/697445/how-to-run-a-powershell-script-on-a-azure-vm-using.html
• https://stackoverflow.com/questions/53414671/azure-logic-apps-how-to-run-powershell-script-or-azure-cli

Regards,
Kamlesh Kumar
BizTalk Techie

Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is How

Want a reminder to come back and check responses? Here is how to subscribe to a Notification

If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators