Try SpotterConfigure DLP sensors.
| "added in version" 2.0.0 of drmofu.fortimanager"
Authors: Xinwei Du (@dux-fortinet), Xing Li (@lix-fortinet), Jie Xue (@JieX19), Link Zheng (@chillancezen), Frank Shen (@fshen01), Hongbin Lu (@fgtdev-hblu)
preview | supported by community
Install with ansible-galaxy collection install drmofu.fortimanager:==2.2.2
collections:
- name: drmofu.fortimanager
version: 2.2.2This module is able to configure a FortiManager device.
Examples include all parameters and values which need to be adjusted to data sources before usage.
- hosts: fortimanager-inventory
collections:
- fortinet.fortimanager
connection: httpapi
vars:
ansible_httpapi_use_ssl: True
ansible_httpapi_validate_certs: False
ansible_httpapi_port: 443
tasks:
- name: Configure DLP sensors.
fmgr_dlp_sensor:
bypass_validation: False
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
rc_succeeded: [0, -2, -3, ...]
rc_failed: [-2, -3, ...]
adom: <your own value>
state: <value in [present, absent]>
dlp_sensor:
comment: <value of string>
dlp-log: <value in [disable, enable]>
extended-log: <value in [disable, enable]>
filter:
-
action: <value in [log-only, block, exempt, ...]>
archive: <value in [disable, enable, summary-only]>
company-identifier: <value of string>
expiry: <value of string>
file-size: <value of integer>
file-type: <value of string>
filter-by: <value in [credit-card, ssn, regexp, ...]>
fp-sensitivity: <value of string>
id: <value of integer>
match-percentage: <value of integer>
name: <value of string>
proto:
- imap
- smtp
- pop3
- ftp
- nntp
- mm1
- mm3
- mm4
- mm7
- mapi
- aim
- icq
- msn
- yahoo
- http-get
- http-post
- ssh
- cifs
regexp: <value of string>
severity: <value in [info, low, medium, ...]>
type: <value in [file, message]>
sensitivity: <value of string>
flow-based: <value in [disable, enable]>
full-archive-proto:
- imap
- smtp
- pop3
- ftp
- nntp
- mm1
- mm3
- mm4
- mm7
- mapi
- aim
- icq
- msn
- yahoo
- http-get
- http-post
- ssh
- cifs
nac-quar-log: <value in [disable, enable]>
name: <value of string>
options: <value in [strict-file]>
replacemsg-group: <value of string>
summary-proto:
- imap
- smtp
- pop3
- ftp
- nntp
- mm1
- mm3
- mm4
- mm7
- mapi
- aim
- icq
- msn
- yahoo
- http-get
- http-post
- ssh
- cifs
feature-set: <value in [proxy, flow]>
entries:
-
count: <value of integer>
dictionary: <value of string>
id: <value of integer>
status: <value in [disable, enable]>
eval: <value of string>
match-type: <value in [match-all, match-any, match-eval]>
adom:
description: the parameter (adom) in requested url
required: true
type: str
state:
choices:
- present
- absent
description: The directive to create, update or delete an object.
required: true
type: str
rc_failed:
description: The rc codes list with which the conditions to fail will be overriden.
elements: int
required: false
type: list
dlp_sensor:
description: the top level parameters set
required: false
suboptions:
comment:
description: Comment.
type: str
dlp-log:
choices:
- disable
- enable
description: Enable/disable DLP logging.
type: str
entries:
description: description
elements: dict
suboptions:
count:
description: Count of dictionary matches to trigger sensor entry match
type: int
dictionary:
description: Select a DLP dictionary.
type: str
id:
description: ID.
type: int
status:
choices:
- disable
- enable
description: Enable/disable this entry.
type: str
type: list
eval:
description: Expression to evaluate.
type: str
extended-log:
choices:
- disable
- enable
description: Enable/disable extended logging for data leak prevention.
type: str
feature-set:
choices:
- proxy
- flow
description: Flow/proxy feature set.
type: str
filter:
description: Filter.
elements: dict
suboptions:
action:
choices:
- log-only
- block
- exempt
- ban
- ban-sender
- quarantine-ip
- quarantine-port
- none
- allow
description: Action to take with content that this DLP sensor matches.
type: str
archive:
choices:
- disable
- enable
- summary-only
description: Enable/disable DLP archiving.
type: str
company-identifier:
description: Enter a company identifier watermark to match.
type: str
expiry:
description: Quarantine duration in days, hours, minutes format
type: str
file-size:
description: Match files this size or larger
type: int
file-type:
description: Select the number of a DLP file pattern table to match.
type: str
filter-by:
choices:
- credit-card
- ssn
- regexp
- file-type
- file-size
- fingerprint
- watermark
- encrypted
- file-type-and-size
description: Select the type of content to match.
type: str
fp-sensitivity:
description: Select a DLP file pattern sensitivity to match.
type: str
id:
description: ID.
type: int
match-percentage:
description: Percentage of fingerprints in the fingerprint databases designated
with the selected fp-sensitivity to match.
type: int
name:
description: Filter name.
type: str
proto:
choices:
- imap
- smtp
- pop3
- ftp
- nntp
- mm1
- mm3
- mm4
- mm7
- mapi
- aim
- icq
- msn
- yahoo
- http-get
- http-post
- ssh
- cifs
description: Check messages or files over one or more of these protocols.
elements: str
type: list
regexp:
description: Enter a regular expression to match
type: str
sensitivity:
description: Select a DLP file pattern sensitivity to match.
type: str
severity:
choices:
- info
- low
- medium
- high
- critical
description: Select the severity or threat level that matches this filter.
type: str
type:
choices:
- file
- message
description: Select whether to check the content of messages
type: str
type: list
flow-based:
choices:
- disable
- enable
description: Enable/disable flow-based DLP.
type: str
full-archive-proto:
choices:
- imap
- smtp
- pop3
- ftp
- nntp
- mm1
- mm3
- mm4
- mm7
- mapi
- aim
- icq
- msn
- yahoo
- http-get
- http-post
- ssh
- cifs
description: Protocols to always content archive.
elements: str
type: list
match-type:
choices:
- match-all
- match-any
- match-eval
description: Logical relation between entries
type: str
nac-quar-log:
choices:
- disable
- enable
description: Enable/disable NAC quarantine logging.
type: str
name:
description: Name of the DLP sensor.
type: str
options:
choices:
- strict-file
description: Configure DLP options.
type: str
replacemsg-group:
description: Replacement message group used by this DLP sensor.
type: str
summary-proto:
choices:
- imap
- smtp
- pop3
- ftp
- nntp
- mm1
- mm3
- mm4
- mm7
- mapi
- aim
- icq
- msn
- yahoo
- http-get
- http-post
- ssh
- cifs
description: Protocols to always log summary.
elements: str
type: list
type: dict
enable_log:
default: false
description: Enable/Disable logging for task.
required: false
type: bool
access_token:
description: The token to access FortiManager without using username and password.
required: false
type: str
rc_succeeded:
description: The rc codes list with which the conditions to succeed will be overriden.
elements: int
required: false
type: list
proposed_method:
choices:
- update
- set
- add
description: The overridden method for the underlying Json RPC request.
required: false
type: str
bypass_validation:
default: false
description: Only set to True when module schema diffs with FortiManager API structure,
module continues to execute without validating parameters.
required: false
type: bool
workspace_locking_adom:
description: The adom to lock for FortiManager running in workspace mode, the value
can be global and others including root.
required: false
type: str
forticloud_access_token:
description: Authenticate Ansible client with forticloud API access token.
required: false
type: str
workspace_locking_timeout:
default: 300
description: The maximum time in seconds to wait for other user to release the workspace
lock.
required: false
type: int
meta:
contains:
request_url:
description: The full url requested.
returned: always
sample: /sys/login/user
type: str
response_code:
description: The status of api request.
returned: always
sample: 0
type: int
response_data:
description: The api response.
returned: always
type: list
response_message:
description: The descriptive message of the api response.
returned: always
sample: OK.
type: str
system_information:
description: The information of the target system.
returned: always
type: dict
description: The result of the request.
returned: always
type: dict
rc:
description: The status the request.
returned: always
sample: 0
type: int
version_check_warning:
description: Warning if the parameters used in the playbook are not supported by
the current FortiManager version.
returned: complex
type: list