Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
adem_netsys
Contributor

SIEM: Admin Login Attempt

Hi guys,

 

I want to write a rule to login with admin for all devices in FortiSIEM, it doesn't matter if it succeeds or fails, I want to get both. How should I proceed with this?

 

Thank you

2 REPLIES 2
AEK
SuperUser
SuperUser
adem_netsys

Hi @AEK 

 

firstly, thank you for reply. Here, there are usually rules related to brute force, I want to see the successful and failed logon attempts of admin and root users, unlike a user's successful logon after failure.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors