Threat Protection Policy

Threat protection policies track suspicious user behavior. For example, if a user fails to enter his or her password correctly multiple times in a row and you have the Excessive Login Failures policy active, FortiCWP will send you an alert. To access Threat Protection policies, go to Policy > Threat Protection from navigation pane.

List of Threat Protection Policies

Access

Policy Name	Description
Excessive Login Failures	Triggers an alert when the number of failed logins for a user exceeds a set threshold.
Password Change	Triggers an alert when passwords are changed.
Suspicious Movement	Triggers an alert when a change in a user's geographic location exceeds threshold parameters.

Suspicious Activity

Policy Name	Description
Restricted User Activity	Triggers an alert when a monitored user performs select activities.
Suspicious Time	Triggers an alert when there is activity outside of work hours.
Suspicious Location	Triggers an alert when there is activity from suspicious locations.

Sensitive Activity

Policy Name	Description
Excessive Event	Triggers an alert when selected event occurrence exceeds threshold.
Ransomware Behavior Detection	Triggers an alert when the directory's file(s) had been replaced.