Fortinet

Communication and Collaboration

Fortinet - Next-gen firewalls and cybersecurity solutions for network security.

Provider: Fortinet

Detection Rule

MITRE Tactic

MITRE Technique

Criticality

Anomalous Network Traffic

Discovery

Network Service Discovery (T1046)

High

Investigation Actions (APIs)	Fetch network traffic logs
	Analyze traffic patterns
Incident Creation Criteria	Traffic spikes exceeding threshold
	Unusual protocols

Unauthorized Access Attempts

Initial Access

Brute Force (T1110)

Critical

Investigation Actions (APIs)	Review authentication logs
	Query failed login attempts
Incident Creation Criteria	X failed login attempts from single IP
	Geolocation anomalies

Malware Detection

Execution

Malicious File Execution (T1203)

Critical

Investigation Actions (APIs)	Fetch endpoint detection logs
	Query for known malware signatures
Incident Creation Criteria	Malware detected on endpoint
	Unusual file downloads

Policy Violations

Defense Evasion

Application Layer Protocol Manipulation (T1502)

Medium

Investigation Actions (APIs)	Review user access logs
	Query for restricted application access
Incident Creation Criteria	Access to blocked applications
	Policy violation alerts

DDoS Attack Detection

Impact

Network Denial of Service (T1498)

Critical

Investigation Actions (APIs)	Fetch traffic logs
	Analyze patterns for potential DDoS
Incident Creation Criteria	Sudden increase in inbound requests
	Threshold-based alerts

Data Exfiltration

Exfiltration

Exfiltration Over Command and Control Channel (T1041)

High

Investigation Actions (APIs)	Review outbound traffic logs
	Analyze large data transfers
Incident Creation Criteria	Unusual data transfer size
	Outbound traffic to unknown destinations

Internal Reconnaissance

Discovery

Account Discovery (T1087)

Medium

Investigation Actions (APIs)	Query user account activity
	Analyze access logs
Incident Creation Criteria	High access frequency for admin accounts
	Internal scanning detected

Credential Dumping

Credential Access

Credential Dumping (T1003)

High

Investigation Actions (APIs)	Review credential access logs
	Query for suspicious command execution
Incident Creation Criteria	Detection of credential dump attempts
	Access to sensitive credentials

Lateral Movement

Remote Services (T1021)

High

Investigation Actions (APIs)	Fetch remote access logs
	Analyze authentication attempts
Incident Creation Criteria	Access from known internal systems
	Unusual remote logins

Command and Control (C2) Activity

Command and Control

Application Layer Protocol (T1071)

Critical

Investigation Actions (APIs)	Query outbound connection logs
	Analyze known C2 IPs
Incident Creation Criteria	Outbound connections to blacklisted IPs
	Unusual DNS queries

APIs and Their Scopes

Detection Rule	API Required	API Scope
Anomalous Network Traffic	/api/v2/firewall/logs	read:logs
Unauthorized Access Attempts	/api/v2/authentication/failures	read:authentication
Malware Detection	/api/v2/endpoint/detection	read:endpoint
Policy Violations	/api/v2/user/access	read:access
DDoS Attack Detection	/api/v2/network/traffic	read:traffic
Data Exfiltration	/api/v2/data/exfiltration	read:data
Internal Reconnaissance	/api/v2/user/accounts	read:accounts
Credential Dumping	/api/v2/credential/access	read:credentials
Lateral Movement	/api/v2/remote/access	read:remote
Command and Control (C2) Activity	/api/v2/network/connections	read:connections

Reports and Widgets for CISO

Report Name	Widgets	Description
Executive Summary Report	Total Incidents	High-level overview of overall security posture, including incident trends and compliance metrics.
	Current Threat Level Compliance Status
Incident Response Summary	Incidents by Type	Details incidents handled, including response times and resolutions.
	Average Response Time Resolved vs. Open Incidents
Threat Landscape Report	Top 10 Threats Detected	Overview of threats detected, categorized by type and source.
	Origin of Threats Threats by Severity Level
Policy Compliance Report	Number of Violations by Policy	Analyzes adherence to security policies and identifies violations.
	Policy Violation Trends Top Violators
Network Traffic Analysis Report	Traffic Volume Over Time	Insights into network traffic patterns and anomalies.
	Anomalous Traffic Events Top Talkers (IP Addresses)
User Activity Report	User Logins Over Time	Monitors user behavior and identifies anomalies.
	Suspicious User Activity Top 10 Users by Access Frequency
Vulnerability Assessment Report	Vulnerabilities by Severity	Identifies vulnerabilities within the network and their statuses.
	Patch Status Overview Top Vulnerable Assets
Endpoint Protection Report	Malware Incidents by Endpoint	Summary of endpoint security incidents and status.
	Endpoint Compliance Status Number of Active Agents
DDoS Attack Analysis Report	DDoS Events Over Time	Reviews DDoS attacks and their impact on the organization.
	Traffic Volume During DDoS Sources of DDoS Attacks
Data Exfiltration Report	Data Transfer Volume Over Time	Overview of potential data exfiltration incidents and outcomes.
	Exfiltration Attempts Detected Top Targeted Data

Menu

Fortinet