LoFP / an address could be added or deleted for legitimate purposes.

Techniques

• t1562

Sample rules

FortiGate - Firewall Address Object Added

• source: sigma
• technicques:
  • t1562

Description

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

Detection logic

condition: selection
selection:
  action: Add
  cfgpath: firewall.address