Elastic high stable kql

First-Time FortiGate Administrator Login

This rule detects the first observed successful login of a user with the Administrator role to the FortiGate management interface within the last 5 days. First-time administrator logins can indicate newly provisioned accounts, misconfigurations, or unauthorized access using valid credentials and should be reviewed promptly.

View Source

Detection Logic

FROM logs-fortinet_fortigate.*, filebeat-* metadata _id
| WHERE data_stream.dataset == "fortinet_fortigate.log" and
        event.category == "authentication" and event.action == "login" and
        event.outcome == "success" and source.user.roles == "Administrator" and source.user.name is not null
| stats Esql.logon_count = count(*),
       Esql.first_time_seen = MIN(@timestamp),
       Esql.source_ip_values = VALUES(source.ip),
       Esql.message_values = VALUES(message) by source.user.name, fortinet.firewall.profile

// first time seen is within 6m of the rule execution time and for the last 5d of events history
| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now())
| where Esql.recent <= 6 and Esql.logon_count == 1

// move dynamic fields to ECS equivalent for rule exceptions
| eval source.ip = MV_FIRST(Esql.source_ip_values)
| keep source.ip,
       source.user.name,
       fortinet.firewall.profile,
       Esql.logon_count,
       Esql.first_time_seen,
       Esql.source_ip_values,
       Esql.message_values,
       Esql.recent

Field Validations

Loading…

Comments (0)

Loading comments...