Edge VPN/Firewall Brute Force Followed by Successful Login from Single Source
Detects a high volume of authentication failures followed by a successful authentication from the same source IP address against edge devices like FortiGate or Palo Alto GlobalProtect within a specific time window.
Microsoft Sentinel (KQL)
