Enrich FortiGate Security Events
Enriches FortiGate security events with MITRE ATT&CK context based on event type, subtype, and action.
Included Processors
1
Parse JSON Body
Parses the JSON string body into a map for field access.
2
Enrich Valid Account Usage
Adds MITRE context for successful FortiGate administrator logins.
3
Enrich Defense Evasion Changes
Adds MITRE context for firewall policy configuration changes.
4
Enrich Brute Force Authentication
Adds MITRE context for failed SSL VPN authentication attempts.
5
Enrich Admin Login Failures
Adds MITRE context for failed administrator login attempts.
6
Enrich VPN Access
Adds MITRE context for successful VPN tunnel establishment.
7
Delete Empty Values
Removes null and empty values after enrichment.