FortiWeb WAF Attack Detected Against Application
Detects an attack identified by the FortiWeb web application firewall. WAF telemetry is widely collected and almost never turned into detection content — it is usually left as a vendor dashboard, so repeated targeting of one application by one source goes unexamined. Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED' | duration 1h | groupby srcip, dstip, threat | select srcip, dstip, threat, count(*) as cnt | having cnt > 10
Sigma
