Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[FORTINET] Login accepted"; content: "32006
| 22
| type="; content: "login"; meta_content: "%sagan%",accepted,successfully; parse_src_ip:2; content:"- - - -"; classtype: successful-admin; sid:5017225; rev:4;)Field Validations
Loading…
Comments (0)
Loading comments...