SIEM: Admin Login Attempt

[adem_netsys]

Hi guys,

I want to write a rule to login with admin for all devices in FortiSIEM, it doesn't matter if it succeeds or fails, I want to get both. How should I proceed with this?

Thank you

[AEK]

Hi Adem

Hope this helps:

https://help.fortinet.com/fsiem/Public_Resource_Access/7_1_1/rules/PH_RULE_BRUTEFORCE_LOGON_SUCCESS....

https://help.fortinet.com/fsiem/Public_Resource_Access/7_1_2/rules/PH_RULE_SUSPICIOUS_FAILED_LOGON_N...

https://help.fortinet.com/fsiem/Public_Resource_Access/7_1_2/rules/PH_RULE_EXCESS_FAILED_LOGON_2_NET...

[adem_netsys]

Hi @AEK 

firstly, thank you for reply. Here, there are usually rules related to brute force, I want to see the successful and failed logon attempts of admin and root users, unlike a user's successful logon after failure.