Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
109
73
41
24
20
Contributors
58
47
46
33
19
Categories
68
66
59
48
40
Platforms
224
51
50
23
10
Products / Services
10,664
9,758
6,692
4,418
3,749
289
MITRE Techniques
69
68
65
54
43
CVEs
12
6
6
6
5
IDS Classtypes
18
3
2
2
1
IDS Protocols
21
2
1
Detects a high volume of authentication failures followed by a successful authentication from the same source IP address against edge devices like FortiGate or Palo Alto GlobalProtect within a specific time window.
Detects successful administrative login events originating from IP addresses outside of configured trusted management networks on Fortinet devices.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects administrative login to the FortiWeb console from an address without prior
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Page 1 of 14