FortiWeb WAF Policy Configuration Changed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an exclusion or switching a policy to monitor-only removes protection from the application behind it — and because the application keeps working normally, nothing else signals that the control has gone. Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='FORTIWEB' and action='CONFIGURATION_CHANGED' | groupby user, config