Fortigate Correlation rules thread

[PA_nts]

Hi All,

With Fortigate FW logs ingesting into XSIAM, even with the forti content pack installed, there is no real method for detection apart from the analytics engine that will use the '3rd party firewalls' analytic rules to natively detect issues/alerts on Fortigate FWs that i am aware off..

As such one will be required to do additional correlation rules for extra detection.

Has anyone done these and willing to share the XQL content of these rules you have created?

I am in the process to design my own and have a number of use cases i want to build out like the following:

Possible Data Exfiltration
Exploit Public Facing
Deserialization Vulnerability
BotC2-Allow
Malicious network traffic from LAN to WAN
Compromised Host
Unwanted or malicious applications detected
Admin Failure
SSL login failure followed by successful

will share once they are tested.

rgds

[amcdonal363]

Are you ingesting data directly from the Fortigate FWs or are you ingesting the firewall data from the FortiAnalyzer?

[PA_nts]

We have both direct from FW > broker-VM  and also via FW > FortiAnalyzer > Broker-VM