Purpose
This guide explains how to configure the FortiWeb Response integration in Logsign USO, so that an analyst (or an action rule) can review and release IPs or users that FortiWeb has blocked, directly from a Logsign Incident. This is a release/recovery-oriented Response integration, configured under Settings > Integrations > Responses > +Device: its methods list and release FortiWeb's own blocklists, they do not create new blocks. FortiWeb performs the actual blocking itself based on its WAF policies; Logsign's role here is to give an analyst visibility into, and a way to release, what FortiWeb has already blocked.
Prerequisites
- A FortiWeb appliance with its REST API reachable from the Logsign server.
- A FortiWeb administrator account with API access, scoped to the relevant VDOM (virtual domain) if your deployment uses VDOMs.
- Use least privilege. Create a dedicated FortiWeb account for this integration if your deployment supports restricted admin profiles, scoped to read/write on the blocked-IP and blocked-user lists rather than a full super-admin profile.
Step 1: Prepare FortiWeb for API Access
- Log in to the FortiWeb management console with an administrator account.
- Create (or designate) a dedicated administrator account for Logsign to use.
- Note the FortiWeb hostname/IP, the VDOM name (if applicable), and the username/password for the account.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for FortiWeb, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this FortiWeb device in Logsign. |
| Host | Yes | Hostname or IP address of your FortiWeb. |
| Username | Yes | The FortiWeb account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
| Vdom | Yes | The virtual domain this account and these blocklists belong to. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls to FortiWeb when enabled. Leave off unless you have a specific reason to keep it on. |
Click Create to save the device.
Available Methods
- get_blocked_ips (Analysis) — lists IPs currently blocked by FortiWeb.
- release_blocked_ips (Recovery) — releases a specific blocked IP.
- release_blocked_ips_all (Recovery) — releases all currently blocked IPs.
- get_blocked_users (Analysis) — lists users currently blocked by FortiWeb.
- release_blocked_users (Recovery) — releases a specific blocked user.
- release_blocked_users_all (Recovery) — releases all currently blocked users.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username/Password. | Re-enter the Username and Password fields and confirm the account can log in to FortiWeb directly. |
| 403 Forbidden | The account's admin profile does not permit reading/releasing block lists, or the Vdom is wrong. | Confirm the account's assigned profile covers the relevant block-list features, and that Vdom matches the domain where the blocks actually occurred. |
| get_blocked_ips/get_blocked_users returns an empty list unexpectedly | Blocks exist in a different VDOM than the one configured, or nothing is currently blocked. | Confirm the Vdom field matches the VDOM where FortiWeb's WAF policies are actually blocking traffic. |
Notes and Limits
- This integration only releases existing FortiWeb blocks; it has no method to create a new block. Blocking behavior itself is governed entirely by FortiWeb's own WAF policies (IP reputation, rate limiting, bot detection, etc.), configured on FortiWeb directly.
- The exact FortiWeb console navigation path for creating a restricted admin account was not independently verified against a live appliance during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.