Hi everyone,
I'm working with FortiSIEM 7.2.3 and I have a use case where I need to validate whether the domain found in the Event URL field is authorized, using a custom lookup table (AuthorizedStorageTenants, column StorageDomain).
Example domains / applications
s3.eu-west-1.amazonaws.com/myapplicationone.off
content.myapplicationtwo.com
files.mystorage.com
If the domain is amazonaws.com, instead checking vs domain I want to check vs path (myapplication.off), because I dont want to "allow" all amazonaws.com ...
My goal is to trigger an alert only if the domain or amazonaws.com path isn't in the lookup.
Has anyone implemented something similar or has recommendations on how to structure this logic efficiently
Thanks in advance!
