VPN Failed Auth Followed by Successful Auth (FortiGate/FortiNet)

Syed Usfar Wasim@nCD24

•updated Jul 22, 2026•15•1•24

This detects a possible VPN brute-force or password-spray followed by successful authentication, where the same user has 5 failed SSL VPN login attempts followed by a successful tunnel-up event within 2 minutes.