|
Default-Compromised-Host-Detection-IOC-By-Threat
|
Default alert handler to detect compromised hosts by FortiAnalyzer IOC feature grouped by threat.
Enabled by default
MITRE Tech IDs:
Rule 1: Traffic to CnC detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Traffic Log > Any
-
Log Field: Destination IP, Endpoint
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: IP, C&C, Ioc_Rescan
-
Custom Message: Traffic to C&C:${dstip}, Traffic path: PolicyID ${policyid}\${dstintf}\${dstip}:${dstport}
Rule 2: Web traffic to CnC detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Web Filter
-
Log Field: Hostname URL, Source Endpoint
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: C&C, URL, Ioc_Rescan
-
Custom Message: Traffic to C&C:${hostname}, Traffic path: PolicyID ${policyid}\${dstintf}\${dstip}:${dstport}
Rule 3:
DNS traffic to CnC detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: DNS Log
-
Log Field: QNAME, Source Endpoint
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: C&C, Domain, Ioc_Rescan
-
Custom Message: Traffic to C&C:${qname}, Traffic path: PolicyID ${policyid}\${dstintf}\${dstip}:${dstport}
Rule 4: Traffic to CnC event detected by FortiGate
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Event Log > System
-
Log Field: Source IP
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: C&C
-
Custom Message: FGT detected traffic to IOC location, from the source ip:${srcip}
|
|
Default-Data-Leak-Detection-By-Threat
|
Default data leak detection handler grouped by threat.
Disabled by default
MITRE Tech ID:
Rule 1: Data leak detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: DLP
-
Log Field: Filter Category, Source Endpoint
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: Signature, Leak
-
Custom Message: File:${filename} (Type:${filetype}, Size:${filesize}), Traffic path: PolicyID ${policyid}\${dstip}:${dstport}
Rule 2: Data leak blocked
-
Alert Severity: Low
-
Log Device Type: FortiGate
-
Log Type: DLP
-
Log Field: Filter Category, Source Endpoint
-
Log messages that match all of the following filters:
-
Status: Mitigated
-
Tags: Signature, Leak
-
Custom Message: File:${filename} (Type:${filetype}, Size:${filesize}), Traffic path: PolicyID ${policyid}\${dstip}:${dstport}
|
|
Default-Sandbox-Detections-By-Endpoint
|
Default handler to track file submission and malware detection by FortiSandbox grouped by endpoint.
Disabled by default
MITRE Tech IDs:
Rule 1: Malware detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: AntiVirus
-
Log Field: Source Endpoint, Virus Name
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: Sandbox, Signature, Malware
-
Custom Message: Malware:${virus} with severity:${crlevel} found in file:${filename} from ${dstip}:${dstport}, Reference: ${ref}
Rule 2: Malware blocked
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: AntiVirus
-
Log Field: Source Endpoint, Virus Name
-
Log messages that match all of the following filters:
-
Status: Mitigated
-
Tags: Sandbox, Signature, Malware
-
Custom Message: Malware:${virus} with severity:${crlevel} found in file:${filename} from ${dstip}:${dstport}, Reference: ${ref}
Rule 3: Sandbox detected Malware
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: AntiVirus
-
Log Field: Source Endpoint
-
Log messages that match any one of the following filters:
-
Status: Unhandled
-
Tags: Sandbox, Malware
-
Custom Message: File:${filename}, Traffic path: ${dstintf}(Policy:${policyid})\${dstip}:${dstport}, Checksum:${analyticscksum}
|
|
Default-Shadow-IT-Events
|
Default alert handler to detect unsanctioned user, application and file exfiltration for cloud access.
This alert handler requires a FortiCASB connector configured on FortiAnalyzer. See Configuring security fabric connectors. This automatically creates the Get Cloud Service Data (FortiCasb Connector) playbook, which must be enabled for this alert handler to generate alerts. See Playbooks.
Disabled by default
MITRE Tech ID:
Rule 1: Unsanctioned Applications detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Application Control
-
Log Field: Source IP, Application Name
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: Unsanctioned_App
-
Custom Message: Unsanctioned application ${app} with app risk: ${apprisk} detected on: ${devname} with message: ${msg}
Rule 2: File Exfiltration Attempts detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Application Control
-
Log Field: Source IP, Application Name
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: File_Exfiltration
-
Custom Message: File exfiltration detected on: ${devname} with message: ${msg}
Rule 3: Unsanctioned Users detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Application Control
-
Log Field: Source IP, Application Name
-
Log messages that match all of the following filters:
-
Status: Unhandled
-
Tags: Unsanctioned_User
-
Custom Message: Unsanctioned user: ${unauthuser} with app risk: ${apprisk} detected on: ${devname} with message: ${msg}
|
|
Local Device Event
|
Default local device alert handler. Available only in the Root ADOM.
Enabled by default
Data Selector: Default Local Device Selector
Rule 1: Critical or important events
-
Alert Severity: Medium
-
Log Device Type: Local Device
-
Log Type: Event
-
Log Field: Log Description
-
Log messages that match the following filters:
-
Tags: System, Local
|
|
Default-NOC-Interface-Events
|
Alert handler for FortiGate device type logs to generate alerts for vlan/interface status up or down, and DNS service on interface status.
Disabled by default
MITRE Tech ID:
Rule 1: Interface status changed to up
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Interface
-
Custom message: Device ${devname}, status changed to ${status} with message ${msg}.
Rule 2: Interface status changed to down
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Interface
-
Custom message: Device ${devname}, status changed to ${status} with message ${msg}.
Rule 3: DNS server config added
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Interface, DNS
-
Custom Message: Device ${devname}, DNS server status changed with message ${msg}.
Rule 4: DNS server config deleted
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match all of the following filters:
-
Tags: NOC, Interface, DNS
-
Custom Message: Device ${devname}, DNS server status changed with message ${msg}.
|
|
Default-NOC-FortiExtender-Events
|
Alert handler for FortiGate device type logs to generate alerts for FortiExtender alerts, authorization and controller activity alerts.
Disabled by default
MITRE Tech ID:
Rule 1: FortiExtender Authorized
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: Device: ${ip} ${action} with message: ${msg}
Rule 2: Warning event detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
Rule 3: Alert event detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
Rule 4: Critical event detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
Rule 5: Error event detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
Rule 6: Emergency event detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
Rule 7: FortiExtender controller activity detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
Rule 8: FortiExtender controller activity error detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > FortiExtender
-
Log Field: SN, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, FortiExtender
-
Custom message: ${action} on ${ip} with message: ${msg}
|
|
Default-NOC-Routing-Events
|
Alert handler for FortiGate device type logs to generate alerts for changes in routing information including BGP Neighbor Status, Routing information change, OSFP Neighbor Status, Neighbor Table Changed and VRRP State Changed.
Disabled by default
Rule 1: Routing information changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Routing
-
Custom message: ${logdesc} on ${devname} with message ${msg}
Rule 2: BGP neighbor status changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Router
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Routing
-
Custom message: ${devname}. BGP neighbor status changed with message ${msg}
Rule 3: OSPF or OSPF6 neighbor status changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Router
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Routing
-
Custom message: ${logdesc} on ${devname} with message ${msg}
Rule 4: Neighbor table changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Router
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Routing
-
Custom message: ${logdesc} on ${devname} with message ${msg}
Rule 5: VRRP state changed
-
Event Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Router
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Routing
-
Custom message: ${logdesc} on ${devname} with message ${msg}
|
|
Default-NOC-Network-Events
|
Alert handler for FortiGate device type logs to generate network alerts including SNMP queries, routing information changes, DHCP server and status changes.
Disabled by default
Rule 1: Device SNMP query failed
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match all of the following filters:
-
Tags: NOC, Network
-
Custom message: Device: ${devname} ${logdesc} with message: ${msg}
Rule 2: Device routing information changed
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Network
-
Custom message: Device: ${devname} ${logdesc} with message: ${msg}
Rule 3: DHCP client lease granted or usage high
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Network
-
Custom message: DHCP status on Device ${devname} is ${logdesc} with message: ${msg}
Rule 4: SNMP enabled
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Network
-
Custom message: Device ${devname} ${logdesc} ${cfgattr} with message ${msg}.
Rule 5: SNMP disabled
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Network
-
Custom message: Device ${devname} ${logdesc} ${cfgattr} with message ${msg}.
Rule 6: DHCP server status changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match all of the following filters:
-
Tags: NOC, Network
-
Custom message: DHCP server status change ${cfgattr} with message ${msg}.
Rule 7: DHCP lease renewed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Network
-
Custom message: Host ${hostname} with message ${msg}.
Rule 8: DHCP lease released
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match all of the following filters:
-
Tags: NOC, Network
-
Custom message: Host ${hostname} with message ${msg}.
|
|
Default-NOC-Switch-Events
|
Alert handler for FortiGate device type logs to generate alerts for Switch-Controller added/deleted or authorized/deauthorized, Switch-Controller Status, Interface flapping, LAG/MCLAG and split-brain status, Cable test/diagnosis and physical port up/down.
Disabled by default
MITRE Tech ID:
Rule 1: Switch-Controller activity detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Message
-
Log messages that match all of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: ${logdesc}
Rule 2: Vlan interface change has occurred
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: Device ${devname} interface vlan change with message: ${msg}
Rule 3: Port switch detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: ${logdesc} on Device: ${devname} with message: ${msg}
Rule 4: Device flap detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Default message
Rule 5: Device LAG-MCLAG status change
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: Device: ${devname} LAG-MCLAG status update with message: ${msg}
Rule 6: Device MCLAG split-brain detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: Device ${devname} ${msg}.
Rule 7: Device cable diagnose detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: Device ${devname} ${msg}.
Rule 8: Device come up detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: Device ${devname} ${msg}.
Rule 9: Device gone down detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Any
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Switch, Controller
-
Custom message: Device ${devname} ${msg}.
|
|
Default-NOC-HA-Events
|
Alert handler for FortiGate device type logs to generate alerts for HA cluster updates and alerts including HA Device interface failure, Cluster Priority Changed, cluster member state moved, device interface down, HA device syncronization status, connection to FortiAnalyzer status, FortiManager tunnel connection status and connection with CSF member status.
Disabled by default
MITRE Tech ID:
Rule 1: HA device interface failed
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > HA
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Default message
Rule 2: Device set as HA primary
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > HA
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device: ${devname} has been set to HA Primary with msg: ${msg}
Rule 3: Cluster state moved or Heartbeat device interface down
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > HA
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device: ${devname} ${logdesc} with HA role: ${ha_role}
Rule 4: Synchronization activity detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > HA
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device: HA synchronization status for Device: ${devname} ${logdesc}. Message: ${msg}. Status is: ${sync_status}
Rule 5: FortiAnalyzer connection up
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device ${devname} ${msg}.
Rule 6: FortiAnalyzer connection failed
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that any one all of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device ${devname} ${msg}.
Rule 7: Upstream connection with CSF member established and authorized
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
direction="upstream" and logdesc="Connection with CSF member established and authorized"
-
Tags: NOC, HA, Cluster
-
Custom message: Device ${devname} ${msg}.
Rule 8: Upstream connection with authorized CSF member terminated
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device ${devname} ${msg}.
Rule 9: FortiManager tunnel connection up
-
Event Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device ${devname} ${logdesc} with message - ${msg}.
Rule 10: FortiManager tunnel connection down
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, HA, Cluster
-
Custom message: Device ${devname} ${logdesc} with message - ${msg}.
|
|
Default-NOC-Wireless-Events
|
Alert handler for FortiGate device type logs to generate alerts for wireless wifi, AP updates and alerts including AP Status Change and Fake/Rogue AP detection, wireless client status change added/removed/allowed or denied status, signal to noise ratio (SNR) poor/fair/good, SSID status up/down.
Disabled by default
Rule 1: Fake AP detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name, SSID
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: ${logdesc}. SN: ${sndetected}
Rule 2: Rogue AP detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name, SSID
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: ${logdesc}. SN: ${sndetected} with message: ${msg}
Rule 3: Wireless event log id matched
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: ${logdesc}. of AP: ${ap}
Rule 4: Wireless client activity detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: ${logdesc} for ${ssid} with message: ${msg}
Rule 5: Signal-to-noise ratio is poor
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: SSID ${ssid}. has a poor quality SNR at ${snr} dB.
Rule 6: Signal-to-noise ratio is fair
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: SSID ${ssid}. has fair quality SNR at ${snr} dB.
Rule 7: Signal-to-noise ratio on is excellent
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: Device Name
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: SSID ${ssid}. has excellent quality SNR at ${snr} dB.
Rule 8: Physical AP radio ssid up
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: SSID, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: Device ${sn} SSID status change with message ${msg}.
Rule 9: Physical AP radio ssid down
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > Wireless
-
Log Field: SSID, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Wireless, Wifi, AP
-
Custom message: Device ${sn} SSID status change with message ${msg}.
|
|
Default-NOC-Security-Events
|
Alert handler for FortiGate device type logs to generate alerts for security alerts including Admin Logins failed or disabled, Admin or Admin Monitor Disconnected, Admin password expired and UTM Profile changes.
Disabled by default
Rule 1: Admin login failed or desabled
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Security, Login, Password
-
Custom message: ${logdesc} for ${user} on device: ${devname} due to: ${reason} with message: ${msg}
Rule 2: Admin password expired
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Security, Login, Password
-
Custom message: Device: ${devname} ${logdesc} with message: ${msg}
Rule 3: Admin disconnected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Security, Login, Password
-
Custom message: ${logdesc} on device: ${devname} with message: ${msg}
Rule 4: AV or IPS change detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Security, Login, Password
-
Custom message: Device: ${devname} ${logdesc} with message: ${msg}
|
|
Default-NOC-Fabric-Events
|
Alert handler for FortiAnalyzer and FortiGate log device type to detect Fabric alerts, including device offline, CSF member connection status down or terminated, CSF member configuration changes, automation stitch triggered , licenses that are expiring or failed updates.
Disabled by default
MITRE Tech ID:
Rule 1: Device offline detected
-
Alert Severity: High
-
Log Device Type: FortiAnalyzer
-
Log Type: Application Log
-
Log Field: Logging Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, Fabric
-
Custom message: ${logdev_id} is offline
Rule 2: FortiAnalyzer connection down detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, Fabric
-
Default message
Rule 3: Connection with authorized CSF member terminated
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Message
-
Log messages that match all of the following filters:
-
Tags: NOC, Fabric
-
Custom message: ${logdesc} on: ${devid} due to: ${reason}
Rule 4: Automation stitch triggered
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Fabric
-
Custom message: ${logdesc} on: ${devname} with message: ${msg} and stitch action: ${stitchaction}
Rule 5: Device license failed or expiring detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, Fabric
-
Custom message: ${logdesc} on: ${devid}
Rule 6: System update or failure detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Message
-
Log messages that match all of the following filters:
-
Tags: NOC, Fabric
-
Custom message: ${logdesc} on: ${devname} with message: ${msg}
Rule 7: Security fabric settings change detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, Fabric
-
Custom message: Device: ${devname} change with message: ${msg}
|
|
Default-NOC-System-Events
|
Alert handler for FortiGate device type logs to generate alerts for system alerts including Power failure and device shutdown, High Resource usage (CPU, Mem, Storage), log device full status warnings and disk rolled, and devices entering/exiting conserve mode.
Disabled by default
MITRE Tech IDs:
Rule 1: Device shutdown detected
-
Alert Severity: Critical
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, System, Power, CPU, Memory, Storage
-
Custom message: ${devname} experienced $logdesc with message: ${msg}
Rule 2: Device conserve mode detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, System, Power, CPU, Memory, Storage
-
Custom message: ${logdesc} on Device: ${devname} with message ${msg}
Rule 3: Disk or memory is full
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, System, Power, CPU, Memory, Storage
-
Custom message: Device: ${devname} ${logdesc} with message: ${msg}
Rule 4: Device high CPU consumption detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, System, Power, CPU, Memory, Storage
-
Custom message: ${devid} performance cpu: ${cpu}
Rule 5: Device high memory consumption detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > System
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, System, Power, CPU, Memory, Storage
-
Custom message: ${devid} performance memory: ${memory}
|
|
Default-NOC-VPN-Events
|
Alert handler for FortiGate device type logs to generate alerts for VPN status changes including IPsec Phase1 error or failure, and Phase2 Up/Down and errors, Ipsec Tunnel Up/Down, VPN SSL login failures, IPSec ESP Error, IPsec DPD failures.
Disabled by default
MITRE Tech IDs:
Rule 1: User SSL VPN login failed
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Source End User
-
Log messages that match any one of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${logdesc} due to: ${reason}
Rule 2: IPsec phase 1 error or status fail detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${logdesc} due to: ${status} with reason: ${reason}
Rule 3: IPsec ESP error detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${status} on: ${devname}, ${error_num}
Rule 4: IPsec DPD failed
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${msg} on device: ${devname}
Rule 5: Device tunnel-up or tunnel-down detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${msg} due to: ${action}
Rule 6: IPsec phase 2 error detected
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Message
-
Log messages that match any one of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${logdesc} due to: ${reason}
Rule 7: Device phase2-up or phase2-down detected
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > VPN
-
Log Field: Device Name, Message
-
Log messages that any one all of the following filters:
-
Tags: NOC, VPN
-
Custom message: ${logdesc} due to: ${action}
|
|
Default-NOC-SD-WAN-Events
|
Alert handler for FortiGate device type logs to generate alerts for SD-WAN status, alerts, and health check alerts including SLA targets/SLA met or not met for jitter, latency, packetloss, Health-check server status (alive or dead), status (up or down), and member status change.
Disabled by default
MITRE Tech IDs:
Rule 1: SLA failed for jitter
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Health Check
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: On ${devname} the SLA for the ${healthcheck} failed for ${metric} with the current value of ${jitter} which violates the target ID ${slatargetid}.
Rule 2: SLA failed for latency
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Health Check
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: On ${devname} the SLA for the ${healthcheck} failed for ${metric} with the current value of ${latency} which violates the target ID ${slatargetid}.
Rule 3: SLA failed for packetloss
-
Alert Severity: High
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Health Check
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: On ${devname} the SLA for the ${healthcheck} failed for ${metric} with the current value of ${packetloss} which violates the target ID ${slatargetid}.
Rule 4: Device status changed to die
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: Device: ${devname} with status ${newvalue}. ${msg}.
Rule 5: Device status changed to alive.
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: Device: ${devname} with status ${newvalue}. ${msg}.
Rule 6: Device status is up
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Health Check
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: Device: ${devname} ${msg} status is ${status}.
Rule 7: Device status is down
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Health Check
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: Device: ${devname} ${msg} status is ${status}.
Rule 8: Number of pass member changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: ${msg} from ${oldvalue} to ${newvalue} for ${devname}
Rule 9: Member status changed
-
Alert Severity: Medium
-
Log Device Type: FortiGate
-
Log Type: Event > SD-WAN
-
Log Field: Device Name, Log Description
-
Log messages that match any one of the following filters:
-
Tags: NOC, SD-WAN
-
Custom message: ${msg}. Member is now ${member} on ${devname}.
|
|
Default-NOC-Docker-Events
|
Alert handler for FortiGate device type logs to generate alerts for Docker including inlcuding container enabled/disabled, CPU value set/max reached and MEM value set/max reached.
Disabled by default
Rule 1: Memory report detected
-
Alert Severity: Medium
-
Log Device Type: FortiManager
-
Log Type: Event
-
Log Field: Type, Subtype
-
Log messages that match any one of the following filters:
-
Tags: NOC, Docker
-
Custom message: Device ${devname} with message ${msg}.
Rule 2: CPU report detected
-
Alert Severity: Medium
-
Log Device Type: FortiManager
-
Log Type: Event
-
Log Field: Type, Subtype
-
Log messages that match any one of the following filters:
-
Tags: NOC, Docker
-
Custom message: Device ${devname} with message ${msg}.
Rule 3: Status changed to disable
-
Alert Severity: Medium
-
Log Device Type: FortiManager
-
Log Type: Event
-
Log Field: Type, Subtype
-
Log messages that match any one of the following filters:
-
Tags: NOC, Docker
-
Custom message: Device ${devname} with changes ${changes}.
Rule 4: Status changed to enable
-
Alert Severity: Medium
-
Log Device Type: FortiManager
-
Log Type: Event
-
Log Field: Type, Subtype
-
Log messages that match any one of the following filters:
-
Tags: NOC, Docker
-
Custom message: Device ${devname} with changes ${changes}.
|
|
ZTNA Brute Force Login
|
Detects various brute force login attempts in ZTNA environments.
Enabled by default
Rule 1: High Volume of Failed Authentications from Multiple Non-Existing Users
Triggers an alert when 100 or more non-existing users have failed authentications to a host name within 10 minutes.
-
Alert Severity: Medium
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: Host Name
-
Log messages that match all of the following filters:
-
Message: High volume of failed authentications from multiple non-existing users to host: $groupby1
-
Tags: ZTNA, Login, AccountDiscovery, BruteForce, CredentialSurfing
Rule 2: Authentication Failed from Multiple Geo Locations
Triggers an alert when an existing account fails to authenticate from three or more different geo locations within five minutes.
-
Alert Severity: High
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: User ID
-
Log messages that match all of the following filters:
-
Data Source Type = FortiAuthenticator
-
Event Sub Type = Authentication
-
Event Profile contains AUTH_FAIL
-
UEBA User ID > 1024
-
Message: Authentication failed from multiple geo locations for user: $groupby1
-
Tags: ZTNA, Login, Geo, BruteForce
Rule 3: Brute Force Login Attack
Triggers an alert when and existing user has 10 or more failed authentications with an event profile containing AUTH_FAIL_LOCK within 10 minutes.
-
Alert Severity: Medium
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Fields: User ID, Event Profile
-
Log messages that match all of the following filters:
-
Data Source Type = FortiAuthenticator
-
Event Sub Type = Authentication
-
Event Profile contains AUTH_FAIL
-
UEBA User ID > 1024
-
Message: Brute force login attack for user: $groupby1
-
Tags: ZTNA, Login, BruteForce
Rule 4: High Volume of Failed Authentications to Same Non-Existing User
Triggers an alert when a non-existing user has at least 100 or more failed authentications within 1440 minutes (one day).
-
Alert Severity: Medium
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: User ID
-
Log messages that match all of the following filters:
-
Message: High volume of failed authentications for non-existing user: $groupby1
-
Tags: ZTNA, Login, BruteForce, DoS
|
|
ZTNA Login Anomaly Detection
|
Detects various suspicious login scenarios in ZTNA environments.
Enabled by default
Rule 1: Authentication to Multiple Services Failed
Triggers an alert when a user has failed authentications to three or more services within 10 minutes.
-
Alert Severity: Medium
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: User ID
-
Log messages that match all of the following filters:
-
Data Source Type = FortiAuthenticator
-
Event Sub Type = Authentication
-
Event Profile contains AUTH_FAIL
-
UEBA User ID > 1024
-
Message: Authentication to multiple services failed for user: $groupby1
-
Tags: ZTNA, Login, PrivilegeEscalation
Rule 2: Successful Authentication from Multiple Geo Locations
Triggers an alert when a user has successful authentication from three or more unique geo locations within 10 minutes.
-
Alert Severity: Critical
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: User ID
-
Log Filter by Text:
-
Message: Suspicious successful authentication from multiple geo locations for user: $groupby1
-
Tags: ZTNA, Login, Geo, ImpossibleTravel
Rule 3: Successful Authentication from Multiple Endpoints
Triggers an alert when a user has successful authentication from five or more different host_IPs within 10 minutes.
-
Alert Severity: High
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: User ID, Host Name
-
Log Filter by Text:
-
Message: Suspicious successful authentication from multiple endpoints for user: $groupby1 to host $groupby2
-
Tags: ZTNA, Login, LateralMovement
Rule 4: Successful Authentication from Sanctioned Countries
Triggers an alert when a user has at least one successful authentication from sanctioned countries within 10 minutes.
-
Alert Severity: Medium
-
Log Device Type: Fabric
-
Log Type: Normalized
-
Log Field: User ID
-
Log Filter by Text:
-
data_sourcetype='FortiAuthenticator' and euid>1024 and ((event_subtype='User' and event_profile='SAML_IDP_PORTAL_LOGIN') or (event_subtype='Authentication' and event_profile~'AUTH_OK')) and (src_geo_country='Russian Federation' or src_geo_country='Belarus' or src_geo_country='Iraq' or src_geo_country='Sri Lanka' or src_geo_country='Central African Republic' or src_geo_country='Syrian Arab Republic' or src_geo_country='Libyan Arab Jamahiriya' or src_geo_country='Korea, Democratic People\'s Republic of' or src_geo_country='Nicaragua' or src_geo_country='China' or src_geo_country~'Iran' or src_geo_country='Venezuela' or src_geo_country='Yemen' or src_geo_country='Lebanon' or src_geo_country='Myanmar' or src_geo_country~'Sudan' or src_geo_country~'Moldova' or src_geo_country~'Congo' or src_geo_country='Guatemala' or src_geo_country='Ukraine' or src_geo_country='Haiti' or src_geo_country='Somalia' or src_geo_country='Zimbabwe')
-
Message: Successful authentication from sanctioned countries for user: $groupby1
-
Tags: ZTNA, Login, Geo, PolicyViolation, Compliance
|
