EvoHub DocsEvoHub Docs Sign in

FortiGate

Use with AI
View as MarkdownThis page as plain text, for pasting into an AI tool Open in ClaudeAsk Claude questions about this page Open in ChatGPTAsk ChatGPT questions about this page
Connect to Cursor / VS Code / ClaudeSearch and read these docs from your AI tool (MCP server)

MCP server URL

https://docs.evohub.io/mcp

Add to CursorAdd to VS Code

Claude Code

claude mcp add --transport http evohub-docs https://docs.evohub.io/mcp

Claude (claude.ai and Claude Desktop): Settings → Connectors → Add custom connector, and paste the URL above.

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "evohub-docs": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://docs.evohub.io/mcp"
      ]
    }
  }
}

Cursor — ~/.cursor/mcp.json

{
  "mcpServers": {
    "evohub-docs": {
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

VS Code — .vscode/mcp.json

{
  "servers": {
    "evohub-docs": {
      "type": "http",
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

llms.txtllms-full.txt

EvoHub receives FortiGate events through an automation stitch: a trigger on the event logs you care about, and a Webhook action that sends the log to EvoHub.

Set it up

Create the integration

In EvoHub, go to On-Call → Integrations → + Add Integration, choose FortiGate, pick an Escalation Policy and click Create Integration. Copy the Webhook URL.

Create the action

In FortiOS, go to Security Fabric → Automation, create an Action of type Webhook with protocol HTTPS, method POST, your webhook URL, and the HTTP body devname=FGT-HQ-01 %%log%%, with FGT-HQ-01 replaced by this FortiGate's hostname. FortiGate replaces %%log%% with the triggering log line in FortiOS's own key=value format (date=… logid="0100032002" … msg="…"), and EvoHub reads it as it is. That log line does not name the device, so the devname= in front of it is what keeps two FortiGates' alerts apart; without it, the same event from every FortiGate on this integration lands on one alert. To keep the key out of the URL, remove ?key=… and add an HTTP header with key Authorization and value Bearer YOUR_INTEGRATION_KEY instead.

Create the trigger

Create a Trigger of type FortiOS Event Log and pick the log IDs that should page — for example administrator login failures, HA failover or VPN tunnel down.

Create the stitch

Create a Stitch that runs the action when the trigger fires.

The same action from the CLI:

config system automation-action
    edit "evohub"
        set action-type webhook
        set protocol https
        set method post
        set uri "evohub.io/ingest/fortigate"
        set port 443
        set http-body "devname=FGT-HQ-01 %%log%%"
        config http-headers
            edit 1
                set key "Authorization"
                set value "Bearer YOUR_INTEGRATION_KEY"
            next
        end
    next
end

Without the header, put the key in the URI instead: set uri "evohub.io/ingest/fortigate?key=YOUR_INTEGRATION_KEY".

Warning

Every log that matches the trigger is one delivery. Trigger on specific event log IDs, not on traffic logs.

What EvoHub reads

EvoHub alert Taken from
Title logdesc and the device name (devname), for example Admin login failed on FGT-HQ-01.
Description msg.
Labels devname, devid, vd, logid, type, subtype, level, eventtype, action, user, srcip, dstip, srcport, dstport, policyid, ui, status, reason, time.

Severity

FortiOS log level EvoHub severity
emergency, alert, critical critical
error high
warning medium
notice low
information, debug info

Resolve and deduplication

An alert is identified by the FortiGate (devname from the HTTP body, else devid) and the log ID. While it is open, the same event again is recorded as Retriggered instead of paging again.

Log entries are events and FortiGate sends no recovery, so alerts stay open until someone resolves them in EvoHub.

Last updated Powered by