Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET] Login accepted"; content: "32006
| 22 2c 22
| type"; content: "login"; meta_content: "%sagan%",accepted,successfully; parse_src_ip: 1; classtype: successful-admin; sid:5014378; rev:4;)Field Validations
Loading…
Comments (0)
Loading comments...