Documentation
Action Manager Settings
Configure the Action Manager settings that control automated defensive responses such as IP blocking and notification processing.
Overview
The Action Manager Settings page lets you view and edit the configuration parameters used by the Action Manager – the background service that receives attack notifications and executes automated defensive responses such as blocking attacker IP addresses on your firewall or web server.
The Action Manager runs continuously alongside the web platform. It listens for incoming attack notifications, deduplicates them, and dispatches blocking actions to the configured targets (FortiNet firewall, web server blocklist, or both). Settings changed on this page are saved to the database immediately and picked up by the Action Manager on its next settings sync, so updates take effect without restarting the service.
Use this page to:
- Review the current Action Manager configuration, grouped into collapsible families.
- Find a setting quickly by searching its name or description.
- Edit individual settings to tune automated response behavior (loop delays, thread counts, batch sizes, timeouts, reconnect back-off and more).
How to Open This Page
- Click Administration in the top navigation bar.
- Click the Action Manager tab (task list icon) in the Administration tab strip.
The page opens at /administration/am and the settings list loads automatically.
Permission required: Your account must belong to a group that has the Modify Settings or View Settings permission. With View Settings only, you can browse and search the list, but the edit buttons are replaced by a dash (—, “Read-only access”). If the Action Manager tab does not appear, ask an administrator to grant one of these permissions to your group.
Main Areas
The page shows the Administration tab strip at the top and, below it, a panel with a search toolbar and the 35 Action Manager settings organized into collapsible setting groups. The panel grows with its content, so expanding groups never cuts off rows.
1Administration tab strip – Users, Groups, Internal Networks, Allowlist, Blocklist, AI, Action Manager, DSS and Retention Policies. The active tab is highlighted.2Search field – filters the list by setting name or description.3Expand all / Collapse all – open or close every setting group with one click.4Group header – the group name, the number of settings in it and a chevron. Click it to collapse or expand the group.5Settings rows – one row per setting, with Name, Value and Actions columns.6Edit button (pencil icon) – opens the Edit Setting dialog for that row.
Settings Table
Each group contains a table with three columns:
| Column | Description |
|---|---|
| Name | A question-mark help icon, the setting’s human-readable description (for example, AMWorker thread loop delay (seconds)) and, underneath in small text, the internal setting name. The internal name is shown without its AM# database prefix and with underscores replaced by spaces. |
| Value | The current value. How it appears depends on the value type (see Value Types below). When the setting has a unit (for example seconds or threads), the unit is shown under the value. |
| Actions | The edit button (pencil icon). Read-only users see a dash instead. |
Row Help Tips
Hover over (or tab to) the question-mark icon at the start of a row to see a short help tip naming the setting and reminding you that the pencil edits its value.
Searching
Type in the Search by name or description… field to show only the settings whose internal name or description contains the text. Matching settings are shown even inside collapsed groups, and the Expand all / Collapse all buttons are hidden while you search. Click the × button in the field, or press Esc, to clear the search and return to your saved group arrangement. If nothing matches, the page shows “No settings match” followed by your search term.
Collapsing Groups
Click a group header to collapse or expand it, or use Expand all / Collapse all. The arrangement is saved in your browser (local storage) separately for each settings page, so it is kept when you switch between administration sections or reload the page.
Value Types
The settings list supports several value types and renders each one differently. All Action Manager settings are currently Integer, except the two direct-actions RabbitMQ names, which are String.
| Type | Display |
|---|---|
| String | Shown as plain text. |
| Integer | Shown as a whole number. |
| Float | Shown as a decimal number. |
| Boolean | Shown as a colored badge reading Enabled (with a check mark) or Disabled (with an X mark). |
| JSON | Shown as a collapsible, syntax-highlighted JSON tree. |
| Password | Any setting whose name contains “password” is shown as a row of asterisks; the stored value is never sent to the browser. |
Settings Reference
The tables below list every Action Manager setting, in the groups shown on the page. Default is the value seeded at installation. Accepted range is enforced by the server when you save (see Validation Rules). Change these values gradually and monitor the effect on the Actions, Notifications and Attacks pages.
Action Manager worker
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| AM_WORKER_DELAY | Integer | 1 | 0 – 86,400 seconds | AMWorker thread loop delay: how often the main processor checks for pending work. |
Defaults & retries
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| DEFAULT_THREAD_DELAY | Integer | 60 | 0 – 86,400 seconds | SettingsUpdater loop delay: how often the Action Manager reloads its settings and the Allowlist from the web platform. Every allowlist format is applied (single IPv4/IPv6 addresses, IPv4/IPv6 CIDR networks and from–to ranges); a malformed entry is skipped and logged, and the other entries still load. |
| DEFAULT_MAX_RETRIES | Integer | 42 | 0 – 1000 retries | Default number of retry attempts for retryable operations. |
| DEFAULT_MAX_RETRIES_DELAY | Integer | 42 | 0 – 86,400 seconds | Delay between retry attempts. |
Action processing
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| ACTION_LOGS_THREAD_DELAY | Integer | 5 | 0 – 86,400 seconds | ActionLogsConsumer loop delay: how often action log records are collected and sent for storage. |
| ACTION_MANAGER_DELAY | Integer | 1 | 0 – 86,400 seconds | ActionsManager thread delay: how often pending defensive actions are checked and executed. |
| ACTION_MANAGER_CLEANUP_TTL | Integer | 60 | 1 – 604,800 seconds | Cleanup interval for the Action Manager cache: how often expired action cache entries are removed. |
| ACTION_MANAGER_ITEM_TTL | Integer | 1800 | 1 – 2,592,000 seconds | Item retention TTL: how long an action item stays in the cache before it is considered expired. |
Attack
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| ATTACK_STATISTICS_THREAD_DELAY | Integer | 5 | 0 – 86,400 seconds | AttackStatisticsConsumer loop delay: how often attack statistics are collected and sent for storage. |
| ATTACK_STATISTICS_CACHED_TTL | Integer | 30 | 1 – 2,592,000 seconds | How long attack statistics stay cached before they can be refreshed. |
Retention
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| RETENTION_POLICY_THREAD_DELAY | Integer | 60 | 0 – 86,400 seconds | RetentionPolicy thread delay: how often retention cleanup checks whether old data should be removed. The retention periods themselves are set on the Retention Policies page. |
Retrieval thresholds
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| RETRIEVED_NOTIFICATION_SEND_THRESHOLD | Integer | 10000 | 1 – 100,000,000 items | Maximum number of notification records sent in one batch. |
| RETRIEVED_ACTION_LOGS_SEND_THRESHOLD | Integer | 10000 | 1 – 100,000,000 items | Maximum number of action log records sent in one batch. |
| RETRIEVED_ATTACK_STATISTICS_SEND_THRESHOLD | Integer | 10000 | 1 – 100,000,000 items | Maximum number of attack statistics records sent in one batch. |
Notifications
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| NOTIFICATIONS_CACHE_CLEANUP_DELAY | Integer | 86400 | 1 – 604,800 seconds | How often the notification cache receives a full cleanup. |
| NOTIFICATIONS_CONSUMER_MAX_QUEUE_SIZE | Integer | 50000 | 1 – 10,000,000 messages | Maximum number of notifications that can wait in the processing queue. |
OpenSearch
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| OPENSEARCH_RETRY_DELAY_MS | Integer | 1000 | 0 – 600,000 milliseconds | Delay before retrying a failed OpenSearch operation. |
General
Settings whose internal names are written in camelCase (no leading family word) are collected in the General group.
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| NotificationsConsumerSendTimeout | Integer | 5 | 1 – 3600 seconds | Maximum wait when sending notification data. |
| NotificationsConsumerDelay | Integer | 1 | 0 – 86,400 seconds | How often incoming notification batches are processed. |
| AMWorkerThreadsCount | Integer | 5 | 1 – 128 threads | Number of parallel AMWorker threads available for blocking work. Higher values improve throughput during large attacks but use more resources. |
| ActionLogsConsumerSendTimeout | Integer | 5 | 1 – 3600 seconds | Maximum wait when sending action log data. |
| ActionLogsConsumerDelay | Integer | 1 | 0 – 86,400 seconds | How often action log batches are processed. |
| AttackStatisticsConsumerSendTimeout | Integer | 5 | 1 – 3600 seconds | Maximum wait when sending attack statistics data. |
| AttackStatisticsConsumerDelay | Integer | 1 | 0 – 86,400 seconds | How often attack statistics batches are processed. |
| OpenSearchReconnectDelay | Integer | 15 | 1 – 3600 seconds | Legacy fixed OpenSearch reconnect delay. |
| OpenSearchReconnectInitialDelaySeconds | Integer | 2 | 1 – 600 seconds | First wait before reconnecting to OpenSearch after a connection loss; later attempts back off up to the maximum below. |
| OpenSearchReconnectMaxDelaySeconds | Integer | 60 | 1 – 3600 seconds | Maximum wait between OpenSearch reconnect attempts. |
| OpenSearchRequestTimeoutSeconds | Integer | 10 | 1 – 600 seconds | Timeout for a single OpenSearch request. |
| RabbitmqReconnectDelay | Integer | 15 | 1 – 3600 seconds | Legacy fixed RabbitMQ reconnect delay. |
| RabbitmqReconnectInitialDelaySeconds | Integer | 2 | 1 – 600 seconds | First wait before reconnecting to RabbitMQ after a connection loss; later attempts back off up to the maximum below. |
| RabbitmqReconnectMaxDelaySeconds | Integer | 60 | 1 – 3600 seconds | Maximum wait between RabbitMQ reconnect attempts. |
| HttpRequestTimeout | Integer | 10 | 1 – 600 seconds | Timeout for HTTP requests used for web-server blocking actions and settings sync. |
| RabbitmqDirectActionsExchangeName | String | notificationsExchange | 1 – 255 characters | RabbitMQ exchange used for direct actions. |
| RabbitmqDirectActionsRoutingKey | String | custom | 1 – 255 characters | RabbitMQ routing key used for direct actions. |
Cached
| Setting | Type | Default | Accepted range | Description |
|---|---|---|---|---|
| CACHED_NOTIFICATION_TTL | Integer | 1800 | 1 – 2,592,000 seconds | How long a notification is remembered for duplicate detection. A repeat of the same attack inside this window is merged instead of processed again. |
Editing a Setting
- Find the setting you want to change (search for it or open its group).
- Click the Edit button (pencil icon) in the Actions column. A dialog titled Edit Setting: followed by the setting name opens.
1Dialog title – “Edit Setting:” and the setting name.2Description – the setting’s description, under the Value label.3Value field – pre-filled with the current value. The input control depends on the setting’s value type (see table below).4Range hint – the accepted range with its unit and the factory default (for example, Accepted range: 1 to 128 threads · Default: 5). For the two String settings, only the default is shown.5Close and Save buttons. Save is disabled while a text or number field is empty.
The input control varies by value type:
Value Type Input Control String A text field (maximum 255 characters). Integer A number field that accepts whole numbers (step of 1), limited to the accepted range. Float A number field that accepts decimal values, limited to the accepted range. Boolean A toggle switch labeled Enabled or Disabled. JSON A code editor with syntax highlighting, line numbers and real-time validation. Change the value.
Click Save to apply the change, or click Close (or the × in the corner) to discard it.
After a successful save, a confirmation message appears, the dialog closes and the list refreshes with the new value.
Validation Rules
Values are checked twice. The browser’s number field refuses values outside the accepted range, and the server validates every update again before saving it. If the server rejects a value, the error message is shown in red directly under the field, the dialog stays open, and nothing is changed.
| Type | Rules |
|---|---|
| String | Must not be empty. Maximum length is 255 characters. |
| Integer | Must be a whole number, not less than -1, and inside the setting’s accepted range from the reference tables above. |
| Float | Must be a number (decimals allowed), not less than -1, and inside the setting’s accepted range. |
| Boolean | Must be true or false. |
| JSON | Must be valid JSON. |
Out-of-range values are rejected with a message naming the setting, the limit and the value entered – for example, AMWorker thread count must be at most 128 threads (got 500).
How the Action Manager Works
The Action Manager is a separate background service that protects your network by automatically responding to detected attacks. Understanding its role helps you make better decisions when adjusting settings on this page.
Processing Pipeline
- Receive – The Action Manager listens on a message queue for attack notifications sent by the detection system.
- Deduplicate – Each notification is checked against a short-lived cache (CACHED_NOTIFICATION_TTL). If the same attack (same target, type, host, port and protocol) was already seen within that window, the duplicate is merged rather than processed again.
- Evaluate – For each new notification, the system checks whether the attacker IP is covered by the Allowlist (trusted IPs that must never be blocked) or has already been blocked. An attacker matches the allowlist if it equals a single-address entry or falls inside a CIDR network or from–to range entry, for IPv4 and IPv6 alike. When an attacker is allowlisted, the action is skipped and the Action Manager logs which allowlist entry matched; no blocking action is executed.
- Act – If the attacker IP is neither allowlisted nor already blocked, the system executes a blocking action. Depending on configuration, this can be a FortiNet firewall rule, a web server blocklist entry, or both.
- Log – Every step is recorded. Action logs, attack statistics and processed notifications are stored in OpenSearch for later review on the Actions and Notifications pages.
Parallel Processing
The Action Manager processes defensive actions on several worker threads in parallel (AMWorkerThreadsCount). More threads improve throughput during large-scale attacks but use more system resources.
Retention
Processed data (notifications, action logs and attack statistics) is kept in OpenSearch for a configurable number of days and then deleted automatically. The retention periods are set on the Retention Policies page; RETENTION_POLICY_THREAD_DELAY on this page only controls how often the cleanup runs.
Settings Sync
The Action Manager reloads its settings every DEFAULT_THREAD_DELAY seconds (60 by default). When you change a value on this page, the Action Manager picks it up on its next sync – typically within a minute. You do not need to restart any service. The Allowlist is synced on the same cycle, so newly trusted IPs, networks and ranges are respected promptly. If one allowlist entry cannot be parsed, only that entry is skipped (and logged); the rest of the list keeps working.
Notes
- Permission required. Users with View Settings can browse the list; only users whose group includes Modify Settings can edit values.
- Password fields are write-only. If a setting name contains the word “password”, the list shows asterisks and the stored value is never sent to the browser.
- Settings are global. A single change on this page affects Action Manager notification processing, action execution, statistics collection and logging.
- No delete or add. You cannot add new settings or delete existing ones from this page. You can only edit their values.
- Environment variables provide initial values. Some Action Manager settings (such as database connection details and queue names) are initially loaded from environment variables in the deployment configuration. Values changed on this page override them on the next sync.
- Clearing the blocked hosts cache. If you need the Action Manager to re-evaluate previously blocked IPs, clear the Blocklist. This sends a
CLEAR_BLOCKED_HOSTS_CACHEcommand to the Action Manager through the message queue.
Related Pages
- Administration – Return to the main administration hub.
- Blocklist – View and manage IP addresses blocked by the Action Manager.
- Allowlist – Manage trusted IPs that the Action Manager will never block.
- Internal Networks – Define the network ranges that the platform protects.
- AI Settings – Configure AI and machine-learning detection parameters.
- DSS Settings – Configure the DSS detection engine thresholds.
- Actions – View the history of automated blocking actions executed by the Action Manager.
- Notifications – See attack notifications that trigger automated responses.