Fortinet Successive different Location Logons
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Fortinet Successive Logon from different locations
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "fortinet_successful_vpn_logon" | timewindow 5m | having DCOUNT(IP_ADDRESS_COUNTRY) > 2 select Action1.timewindow.HOSTNAME,Action1.timewindow.USERNAME,Action1.timewindow.REMOTE_IP,Action1.timewindow.MESSAGE,Action1.timewindow.TUNNEL_ID,Action1.timewindow.C_IP_COUNTRY,Action1.timewindow.PRIVATE_IP,Action1.timewindow.IP_ADDRESS_COUNTRY
Detection
Execution Mode
realtime
Log Sources
Fortinet
