Automation Stitch Trigger and Action for IPS
An administrator configures an automation stitch on FortiGate to automatically block an IP address when a specific IPS signature triggers. What must be configured as the trigger and action?
Quick Answer
The correct answer is the trigger set to 'Event Log' with a filter for the specific IPS signature, and the action set to 'Add IP to Blocklist'. This configuration is correct because an automation stitch on FortiGate requires a trigger that defines the initiating event and an action that executes the response; for automatic IP blocking, the Event Log trigger captures the IPS signature log entry, and the Add IP to Blocklist action extracts the source IP and adds it to the banned IP list, creating a direct, automated containment loop. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how automation stitches bridge detection and response, often appearing as a scenario where a trap is to confuse the trigger with 'IPS Signature' itself or the action with 'Email Alert'—remember that the trigger must be a log event, not the signature object. A useful memory tip is "Log to Lock": the trigger must log the event, and the action must lock the IP into the blocklist.
⚠ Common exam trap
A common mix-up: candidates confuse 'Banned IP' (a status or list) with the actual action name 'Add IP to Blocklist', or they mistakenly think a CLI script or webhook can directly react to an IPS event without the proper log-based trigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'
An automation stitch in FortiGate requires a trigger that defines the event that starts the automation, and an action that defines what happens when the trigger fires. For automatically blocking an IP when a specific IPS signature triggers, the trigger must be 'Event Log' with a filter for that IPS signature, and the action must be 'Add IP to Blocklist', which directly adds the source IP to the FortiGate's blocklist (banned IP list). This combination ensures that when the IPS signature is logged, the stitch extracts the source IP and applies a block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Trigger: 'Event Log' with filter for the IPS signature; Action: 'Add IP to Blocklist'
Why this is correct
Event log triggers on specific log IDs; action adds IP to blocklist.
- ✗
Trigger: 'Incoming Webhook'; Action: 'CLI Script'
Why it's wrong here
Webhook is not a trigger for IPS events.
- ✗
Trigger: 'FortiOS CLI'; Action: 'Alert Email'
Why it's wrong here
FortiOS CLI is not a trigger.
- ✗
Trigger: 'Schedule'; Action: 'Banned IP'
Why it's wrong here
Schedule is time-based, not event-driven.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which FortiGate feature can automatically block traffic from an IP address that is detected as malicious by FortiSandbox?
easy- A.Traffic Shaping
- B.Intrusion Prevention System (IPS)
- C.Application Control
- ✓ D.Automation Stitch
Why D: Automation Stitch in FortiOS allows you to create a trigger-action pair that automatically blocks an IP address when FortiSandbox detects malicious activity. The trigger can be a FortiSandbox IOC (Indicator of Compromise) event, and the action can be an IP block via a local or external block list, enabling real-time, automated threat response without manual intervention.
Variation 2. A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?
medium- A.The IPS event severity threshold is set too low
- B.The automation stitch is disabled
- ✓ C.No SMTP server is configured in the FortiGate
- D.The IPS engine is in monitor mode
Why C: The automation stitch requires a functional SMTP server configuration to send emails. Without an SMTP server defined under System > Settings > Email Service, the FortiGate cannot relay the alert email, even if the trigger and action are correctly configured and events are logged. This is the most common reason for email delivery failure in automation stitches.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.