FortiMail API

A common use is a user missing an email: the agent finds the message in the FortiMail quarantine, reads which policy and profile held it, and releases it when it is safe.

Automatically enabled when you configure FortiMail permissions in your agent workflow.

What It Does

Read system status, licenses, HA and disk status, and mail statistics
Read protected domains, their settings, mail users, aliases and address maps
Read recipient and IP policies and access control rules, in the order FortiMail applies them
Read antispam, antivirus, content, session, TLS, impersonation and DLP profiles
Read and change system, domain and personal safelists and blocklists, and email and IP address groups
List the system quarantine and release a message
Read the history log
Change domains, users, policies, profiles and settings, and restart or reload the appliance

How the agent works a missing email

The agent finds the recipient’s protected domain and looks for the message in the quarantine folders. It reads why FortiMail held it: the lists, the access rules, the policy that matched and the profile it applied. It explains this on the ticket, and releases the message when the sender is known and FortiMail did not class it as a virus, malware or impersonation. A release follows the Quarantine area’s approval setting.

Permission Groups

Group	Access levels	Covers
System Status and Statistics	Disabled, Read Only, Read / Write	Status, licenses, HA and RAID, mail statistics, restart and reload
Domains and Users	Disabled, Read Only, Read / Write	Protected domains, mail users, aliases, address maps, user groups, address books
Policies and Access Control	Disabled, Read Only, Read / Write	Recipient and IP policies, access control rules
Security Profiles	Disabled, Read Only, Read / Write	Antispam, antivirus, content, DLP, session, TLS, URI filter, impersonation and notification profiles
Safelists, Blocklists and Groups	Disabled, Read Only, Read / Write	Safelists and blocklists, address groups, greylist, reputation and exempt lists
Quarantine	Disabled, Read Only, Read / Write	The system quarantine, releasing a message, quarantine settings
Logs and Reports	Disabled, Read Only, Read / Write	History log, log settings, alert email, log reports
Mail Settings, Archiving and Encryption	Disabled, Read Only, Read / Write	Mail server settings, storage, disclaimers, archiving, IBE encryption, backups
Network and System Settings	Disabled, Read Only, Read / Write	Interfaces, routes, DNS, HA, SNMPv3, FortiGuard, global settings
Administrators and Authentication	Disabled, Read Only, Read / Write	Administrators, admin profiles, PKI users, authentication profiles

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read	Every change in Quarantine (releasing mail, quarantine settings) and in Safelists, Blocklists and Groups (lists, address groups, reputation and exempt lists); nothing else may change
IT Admin	The quarantine, domains, profiles, logs, mail and system settings, restarts	Safelists, blocklists, policies and access rules, and every write under Safety Controls
Full Automation	Every write except those below	Only the writes below

Safety Controls

Control	Behavior
Administrators	Every change to administrators, admin profiles, PKI users and authentication profiles always asks a technician
Protected domains	Deleting a protected domain always asks a technician
Credentials	A change that stores a password or shared secret always asks a technician, and Neo removes every credential field from what FortiMail returns
Right client	On a ticket, a call that names a protected domain goes out only for a domain linked to the ticket’s client on the Organization Mapping tab, and the list of every domain is refused, and so is any domain association read or change, which a technician makes. A quarantine release that also sends the message to other addresses goes out only when each is in the client’s linked domains
Unknown actions	A request with an action FortiMail does not document, and a write to a resource Neo does not list, are refused
Refused	Neo signs in itself with the administrator you saved and never gives an agent the session; an agent cannot call the sign-in or sign-out endpoints, upload files (firmware, configuration or list restores), restore mail data from a backup, or read or change SNMP communities, or shut the appliance down

How to Configure

Connect FortiMail

Save your FortiMail address and Neo’s administrator in the Neo Dashboard under the Security integrations category. See Connecting FortiMail to Neo.

Configure permissions

In your agent workflow’s Integrations tab, choose an access profile or set each permission group by hand.

Start with Read Only. Explaining why a message was quarantined, reviewing a client’s policies and correlating an incident need only reads; add the Quarantine area when you want the agent to release mail.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

How the agent works a missing email

Permission Groups

Access Profiles

Safety Controls

How to Configure

​What It Does

​How the agent works a missing email

​Permission Groups

​Access Profiles

​Safety Controls

​How to Configure

What It Does

How the agent works a missing email

Permission Groups

Access Profiles

Safety Controls

How to Configure