FortiGate Firewall Policy Change Outside Business Hours

Rudra Verma@Rudraverma

•updated Feb 5, 2026•9•0•156

This rule detects configuration changes to Fortinet FortiGate firewall policies that occur outside of standard business hours (before 8 AM or after 5 PM NZDT). It specifically looks for actions like 'Move', 'Add', 'Enable', 'Delete', or 'Edit' on firewall policies. This can indicate unauthorized access or malicious activity, as legitimate changes are typically performed during business hours.