Add FortiGate CommonSecurityLog behaviors - #14794
Open
miriweissler wants to merge 1 commit into
Open
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 362ef6cc-07cb-4680-a728-99df70d6ff68
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds FortiGate-specific behavior IDs/titles to the CommonSecurityLog behavior catalog and updates the total behavior count accordingly.
Changes:
- Added 41 FortiGate behavior entries (name + title) to the catalog table
- Updated Total Behaviors from 142 to 183
- Attempted to keep the table alphabetically ordered by behavior name
Comment on lines
139
to
+142
| | BehaviorRepeatedIkeProbing | Repeated Outbound IKE VPN Service Probing From Single Internal Host | | ||
| | BehaviorRepeatedSSHFailures | Repeated SSH Negotiation Failures from a Remote Address | | ||
| | BehaviorRepeatedSmbAdminAccess | Repeated SMB Administrative Share Access Attempts Logged as Palo Alto Threats | | ||
| | BehaviorRepeatedSslVpnDenials | Repeated SSL VPN Web Access Denials from Single Remote IP | |
Comment on lines
+149
to
154
| | BehaviorSSHBackupFailure | Repeated Failed Configuration Backup from SSH | | ||
| | BehaviorSSHNegotiationFailure | Repeated SSH Negotiation Failures From a Source Address | | ||
| | BehaviorSSLVPNBruteForceByRemoteAddress | Repeated SSL VPN Access Failures from a Remote Address | | ||
| | BehaviorSSLVPNBruteForceByUser | Repeated SSL VPN Authentication Failures Against FortiGate User Accounts | | ||
| | BehaviorSSLVPNPasswordSpray | SSL VPN Login Failures from One Remote IP Across Multiple Accounts | | ||
| | BehaviorScadaProtocolExploit | Exploitation: SCADA DNP3 or Modbus Protocol Exploit Signature on Internal Traffic | |
Comment on lines
+151
to
+153
| | BehaviorSSLVPNBruteForceByRemoteAddress | Repeated SSL VPN Access Failures from a Remote Address | | ||
| | BehaviorSSLVPNBruteForceByUser | Repeated SSL VPN Authentication Failures Against FortiGate User Accounts | | ||
| | BehaviorSSLVPNPasswordSpray | SSL VPN Login Failures from One Remote IP Across Multiple Accounts | |
| | BehaviorVaultMultiAccountOperations | CyberArk client host performing multiple vault file operations via different accounts | | ||
| | BehaviorVoiceSignalingC2 | Command and Control – Voice Signaling Protocol Connectivity Across Firewall Boundaries | | ||
| | BehaviorVoipBypassOutbound | Outbound Encrypted VoIP Bypass Sessions From Internal Host to External Service | | ||
| | BehaviorVpnAccountBruteforce | Repeated Remote VPN Authentication Failures for a Single Account | |
| List of behavior detection rules for CommonSecurityLog data source (CyberArk, Palo Alto, etc.) | ||
|
|
||
| **Total Behaviors**: 142 | ||
| **Total Behaviors**: 183 |
Contributor
|
Hi @miriweissler, please accept CLA. Thanks!! |
Author
@microsoft-github-policy-service agree company="Microsoft" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Titles were sourced from the corresponding rules in
InE.MtpCorrelationRules.