Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET] Login accepted"; content: "32006
| 22
| type="; content: "login"; meta_content: "%sagan%",accepted,successfully; parse_src_ip: 1; content:!"- - - -"; classtype: successful-admin; sid: 5000908; rev:4;)Field Validations
Loading…
Comments (0)
Loading comments...