FortiWeb WAF Administrative Account Deleted
Detects deletion of an account on the FortiWeb WAF. Removing administrators during an intrusion denies the organisation control of its own protection at the moment it most needs it, and it erases the record of entitlement alongside. Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='FORTIWEB' and action='USER_DELETED' | groupby targetuser, role
Sigma
