FortiAuth: Authentication success by user . · data.status = Success

Description

FortiAuth: Authentication success by user $(dstuser).

Query · wazuh

field data.status="Success"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 44730 Alert from Forti Authenticator. anchor level 0
    decoded_as=fortiauth
  2. 44731 FortiAuth: Authentication event. anchor level 0
    field subcategory="Authentication"
  3. 44734 FortiAuth: Authentication success by user . · data.status = Success refinement level 3 this rule
    field data.status="Success"

Rule dependencies

Depends on

Raw source FortiAuth: Authentication success by user . · data.status = Success · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="44734" level="3">
    <if_sid>44731</if_sid>
    <field name="data.status">Success</field>
    <description>FortiAuth: Authentication success by user $(dstuser).</description>
    <group>hipaa_164.312.d,pci_dss_8.2</group>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.