Technical Reference

Post-alert Action Example

Standardize enrichment, notification, temporary blocking, and support-ticket actions after an alert.

IP, user, device, and license values on this page are anonymized.

incident: VPN_BRUTE_FORCE
actions:
  1. enrich source.ip with country/asn/last_seen
  2. notify admin and customer contact
  3. apply temporary block only when policy allows
  4. open support ticket with anonymized evidence

Let us design your deployment plan

Let’s plan the right architecture for your FortiGate, Wazuh, and log pipelines together.

Contact us
Post-alert Action Example | Documentation | Bivoxy