Can FAZ update a threat feed based on FAC logs for "AUTH_FAIL_NOUSER"?

[80211WiGuy]

Hello,

I'm pretty new to FAZ but we were sold on it based on it's ability to trigger actions based on log events.  Now that we have it, I'm not sure it can do what I had planned though.

Problem:  We're trying to phase-out SSL-VPN but can't right now.  We see constant attempts from certain subnets trying random user-names to log in that we'd like to block, but we don't want to block legitimate users that may have mistyped they're username.  The FAC log we see for this is "AUTH_FAIL_NOUSER" in the Log Description field.

Solution:  I'd like to detect instances of "AUTH_FAIL_NOUSER" and note the <User IP>.  If the User IP makes more than 5 attempts in 5hrs.  Add that IP to a threat feed (maybe on FMG), or at least send an alert.

Currently I'm doing this manually by checking the logs whenever I have time, and adding it to a threat feed we host on an internal github server.

I was trying to search for a solution like this but haven't come across one yet.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[farhanahmed]

Hi,

You can use custom event handler to trigger an email alert:

Please refer to the doc:
https://docs.fortinet.com/document/fortianalyzer/7.6.4/administration-guide/348606/creating-a-custom...

In your case, identity the logs in FortiAnalyzer Log View and then use the log field in event handler to trigger the alert.
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-create-an-Event-Handler-in-FortiAn... 


Troubleshoot Event Handlers:
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-How-to-troubleshoot-for-event-ha...