Fortinet Automation: High CPU + Quarantine Example

How to use automation stitches and if/then (or Trigger/Action) logic to automate responses/alerts. Two example use cases are:
1) High CPU Email Alert
2) MAC quarantine based on Virus detection
MAC Quarantine CLI Action
#################################################
config user quarantine
config targets
edit "mac_quarantine"
config macs
edit %%log.epmac%%
end
end
end
#################################################
0:00 Overview of FortiGate Automation
2:10 Example1: FortiGate High CPU
4:03 Example2: FortiGate, FAZ, FortiSwitch Quarantine
13:53 Troubleshooting/Debug on FortiGate

[@sridharbv6791]

great video

[@Aymanb298]

Thank you, as usual very informative. I was looking for trigger for certificate in fortigate if they are expired or about to be expired, is there any kind of trigger for such cases. Also would you consider to make a video for SAML. Im little bit confuse when SAML involved in any configuration, so whith what soultion we can use it, Fortigate as idp or ids.

[@tothepointfortinet3823]

I've looked and haven't been able to find the expired cert notification. For SAML I plan a future video with FAC as IDP

[@Nikoolayy1]

What about blocking AD User not only MAC address or IP address?

[@tothepointfortinet3823]

I don't believe that's an action item on the fortigate. Might need to consider a more advanced orchestration tool for that (ie. FortiSOAR)