Geo-alerting event handlers

This topic describes the related logs and predefined event handlers that can be used for geo-alerting. These can be helpful for threat detection in scenarios such as multiple authentications to the same account from different geo locations or impossible travel between logins, indicating a likely breach.

The predefined event handler rules that are created for geo-alerting rely on the following fields, which are available for all log types:

• Source City (srccity)

• Destination City (dstcity)

• Source Country (srccountry)

• Destination Country (dstcountry)

These fields depend on the IP. When the IP is a public IP, the related city and country will display in the fields listed above. For example, see below.

In other scenarios, the fields are displayed as follows:

• When the IP is invalid, these fields are empty.

• When there is no IP, these fields are empty.

• When the IP is a private IP, these fields display Reserved.

These source and destination fields can also be parsed to Fabric logs in the SIEM database. All predefined log parsers are updated to parse the srccity, dstcity, srccountry, and dstcountry fields into the normalized SIEM fields src_geo_city, src_geo_country, dst_geo_city, and dst_geo_country in Fabric logs.

For example, see the Fabric logs with Source City, Source Country, Destination City, and Destination Country populated in the table view.

The following predefined event handler includes multiple rules to detect suspicious login activities from different IPs/Countries:

• Default-Multiple-Authentications-to-the-Same-Account

In addition to the event handler above, the following predefined event handler includes one rule for geo alerting as well:

• ZTNA Login Anomaly Detection: Impossible Travel Login Detection

These event handlers are enabled by default. They use normalized Fabric logs to detect events.

The following topology was used for the examples below.

Default-Multiple-Authentications-to-the-Same-Account

Default-Multiple-Authentications-to-the-Same-Account is a basic event handler detects multiple failed or successful authentication attempts to the same network device or domain using the same account but originating from different IP addresses or geo locations.

This event handler uses the predefined data selector Default Microsoft Windows Security Auditing Log to ensure the proper devices and logs are used to trigger events.

MITRE coverage:

• MITRE Tech ID = T1078 Valid Accounts.

Rule details:

Rules	Description
Authentication to the Same Device from Different Public IPs	Triggers an event when a user has four failed or successful authentications to the same device from different public IPs within 30 minutes. Event Severity: Medium Log Field: Host Name, User Name Log Filter by Text: (event_id = '4624' or event_id = '4625') and src_geo != '0' and src_geo != '1000000000' Event Message: Authentication attempts on host: $groupby1 by user: $groupby2 from different public IP addresses Tags: ValidAccounts Additional Info: Authentication for application: ${app_ref} Using Windows logs, event ID 4624 indicates a successful login and event ID 4625 indicates a failed login.
Authentication to the Same Domain from Different Public IPs	Triggers an event when a user has four failed or successful authentications to the same domain from different public IPs within 30 minutes. Event Severity: Medium Log Field: Destination Domain, User Name Log Filter by Text: (event_id = '4624' or event_id = '4625') and src_geo != '0' and src_geo != '1000000000' Event Message: Authentication attempts to domain: $groupby1 by user: $groupby2 from different public IP Addresses Tags: ValidAccounts Additional Info: Authentication for application: ${app_ref}
Authentication to the Same Device from Different Geo Locations	Triggers an event when a user has three failed or successful authentications to the same device from different countries within one hour. Event Severity: Critical Log Field: Host Name, User Name Log Filter by Text: (event_id = '4624' or event_id = '4625') and src_geo != '0' and src_geo != '1000000000' Event Message: Authentication attempts on host: $groupby1 by user: $groupby2 from different Geo Locations Tags: ValidAccounts Additional Info: Authentication for application: ${app_ref}
Authentication to the Same Domain from Different Geo Locations	Triggers an event when a user has three failed or successful authentications to the same domain from different countries within one hour. Event Severity: Critical Log Field: Destination Domain, User Name Log Filter by Text: (event_id = '4624' or event_id = '4625') and src_geo != '0' and src_geo != '1000000000' Event Message: Authentication attempts to domain: $groupby1 by user: $groupby2 from different Geo Locations Tags: ValidAccounts Additional Info: Authentication for application: ${app_ref}

Events triggered by this event handler are visible in the Event Monitor:

You can double-click an event to view the related logs. In this example, there is login activity from multiple countries for a single user to the MS Exchange Server.

ZTNA Login Anomaly Detection: Impossible Travel Login Detection

You can find the Impossible Travel Login Detection rule in the predefined ZTNA Login Anomaly Detection event handler.

For this rule to trigger events, you must also have a FortiAuthenticator configured in your network and logging to FortiAnalyzer.

Rule details:

data_sourcetype='FortiAuthenticator' and euid>1024 and app_state='Success' and event_subtype='Authentication' and event_action='Authentication'

GEO_DISTANCE(1, 'km') alias geo_distance > TIME_DIFF(1, 'hour') alias time_diff * (geo_distance > 400 ? then 1400 else 100) and geo_distance > 200 and time_diff > 0.1 and not cellular and not cloud and not usual_locations

The table below describes the individual conditions set in Advanced Mode to trigger an event. All of the conditions must be met to trigger an event.

If appropriate for your environment, you can clone the event handler and remove the following conditions in the Advanced Mode field according to your needs: not cellular not cloud not usual_locations not privateIP

You can find the related events in the Event Monitor:

The Event Monitor displays the customized event message, including the username in the Event column. The event status, severity, type, and tags are also included in their respective columns. Additionally, using the additional info confugured in the rule, the Additional Info column provides further information about the event at a glance.

Right-click an event in the Event Monitor and select View Logs to display the consecutive logs:

Right-click an event in the Event Monitor and select Search in Log View to display all the related logs:

This rule is also configured to create indicators to display the previous login and new login location. If the alert is updated, you can also see the new geo-login information in the indicator as well.

In Event Monitor, you can include the Indicators column to view the indicators related to these events.

Click a link in this column to display the Indicators pane with more information. For example, see the Indicators pane below which displays the previous and current login:

To enable, disable, and troubleshoot the geo location function in the FortiAnalyzer CLI:

You can use the following commands to enable, disable, and troubleshoot the geo location function in FortiAnalyzer.

Command to enable the geo location function:

diagnose test application sqllogd 231 .geolocation enable

Command to disable the geo location function:

diagnose test application sqllogd 231 .geolocation disable

Other related commands:

  # diagnose test application sqllogd 231

    Geo-Location diag usage:
    info                      geoip cache info
    countrylist               list all country names
    ip4dump                   dump ip4 ranges
    ip6dump                   dump ip6 ranges
    ip                        find IP's country
    fgt-cfg-cache             dump fgt-geo-cfg-cache info