How to send alert email when abnormal increase in RDP/session count on FortiGate

i know that there is a snmp oid that tracks the overall session count, not per specific port/service.

Hi Deadwavevaef,
 

FortiOS does not have a single "RDP count" trigger, you can use a combination of DoS Policy logs or CPU/Memory thresholds which often spike during session floods.
 

DoS Policy Trigger (Recommended for RDP): Create a DoS Policy (under Policy & Objects > DoS Policy) for RDP traffic (Port 3389). Set a threshold if the sessions exceed this, it generates a log.
 

https://community.fortinet.com/fortigate-3/technical-tip-how-to-enable-dos-logs-in-fortigate-209339
 

If you have found a solution, please like and accept it to make it easily accessible to others.
 

Regards,
Aman

I didn’t try it but probably the simplest way to do ii with FGT only is with DOS policy + automation stitch, since DOS policy is the one that has statistics on session rate per service/port.