Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
3
2
2
Platforms
3
Products / Services
3
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects bulk or frequent modifications to firewall policies across various network vendor devices, including Fortinet, Cisco Meraki, WatchGuard, and Sophos. The rule identifies high volumes of policy changes within a 15-minute window or logs summary counts to highlight potentially unauthorized administrative activity.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.