Sagan high stable other

[FORTINET] Admin Login Failed [5/5]

[FORTINET] Admin Login Failed [5/5]

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET] Admin Login Failed [5/5]"; json_content: ".logid", "0100032002"; json_map: "username", ".user"; after: track by_src&by_username, count 5, seconds 300; threshold: type suppress, track by_src&by_username, count 1, seconds 86400; classtype: attempted-admin; json_map: "src_ip", ".srcip"; json_map: "dest_ip", ".dstip"; sid:5014452; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...