Fortigate Correlation rules thread

PA_nts — Mon, 23 Feb 2026 14:43:46 GMT

Hi All,

With Fortigate FW logs ingesting into XSIAM, even with the forti content pack installed, there is no real method for detection apart from the analytics engine that will use the '3rd party firewalls' analytic rules to natively detect issues/alerts on Fortigate FWs that i am aware off..

As such one will be required to do additional correlation rules for extra detection.

Has anyone done these and willing to share the XQL content of these rules you have created?

I am in the process to design my own and have a number of use cases i want to build out like the following:

Possible Data Exfiltration
Exploit Public Facing
Deserialization Vulnerability
BotC2-Allow
Malicious network traffic from LAN to WAN
Compromised Host
Unwanted or malicious applications detected
Admin Failure
SSL login failure followed by successful

will share once they are tested.

rgds

Re: Fortigate Correlation rules thread

amcdonal363 — Mon, 23 Feb 2026 20:50:46 GMT

Are you ingesting data directly from the Fortigate FWs or are you ingesting the firewall data from the FortiAnalyzer?

Re: Fortigate Correlation rules thread

PA_nts — Tue, 24 Feb 2026 05:59:03 GMT

We have both direct from FW > broker-VM and also via FW > FortiAnalyzer > Broker-VM

topic Fortigate Correlation rules thread in Cortex XSIAM Discussions

Fortigate Correlation rules thread

Re: Fortigate Correlation rules thread

Re: Fortigate Correlation rules thread