FortiWeb WAF Console Authentication From New Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects administrative login to the FortiWeb console from an address without prior history. Console access permits policy change and signature control, so compromise of the WAF administrator is equivalent to removing the WAF for every application behind it. Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='FORTIWEB' and action='LOGIN' | groupby user, srcip