From 6faa11db0024d55becc483d4e93b6a3e32f62db6 Mon Sep 17 00:00:00 2001 From: Chelsea Wright Date: Fri, 3 Jul 2026 14:14:15 +0200 Subject: [PATCH] feat(data_library): add FortiGate security-enrichment kv samples Add 5 FortiGate key=value event records that exercise MITRE ATT&CK enrichment conditions (admin login success/failure, firewall policy change, SSL-VPN login failure, VPN tunnel establishment) used by the enrich-fortigate-security-logs blueprint. ParseKeyValue handles the double-quoted values natively. --- .../embeddedlibrary/data_library/fortinet/fortigate.log | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/generator/filegen/embeddedlibrary/data_library/fortinet/fortigate.log b/generator/filegen/embeddedlibrary/data_library/fortinet/fortigate.log index f703dff..1baaa8a 100644 --- a/generator/filegen/embeddedlibrary/data_library/fortinet/fortigate.log +++ b/generator/filegen/embeddedlibrary/data_library/fortinet/fortigate.log @@ -3,3 +3,8 @@ <134>%c fortigate.security.test FortiGate: type=traffic subtype=allowed policyid=20 policytype=policy action=accept severity=notice srcip=10.0.0.1 dstip=172.16.0.1 srcport=54322 dstport=443 protocol=tcp service=https sent=2048 rcvd=4096 appname="HTTPS" <134>%c fortigate.security.test FortiGate: type=attack subtype=ids policyid=25 policytype=policy action=blocked severity=high srcip=10.20.30.40 dstip=192.0.2.1 srcport=12345 dstport=22 protocol=tcp attack="SSH.Brute.Force" msg="Multiple failed SSH connection attempts" <134>%c fortigate.security.test FortiGate: type=traffic subtype=blocked policyid=0 policytype=policy action=deny severity=warning srcip=172.31.0.5 dstip=203.0.113.3 srcport=54323 dstport=3389 protocol=tcp service=rdp msg="RDP traffic blocked by firewall rule" +<134>%c fortigate.security.test FortiGate: type=event subtype=system action=login status=success user="admin" ui="ssh(10.0.0.5)" logdesc="Admin login successful" msg="Administrator admin logged in successfully from ssh(10.0.0.5)" +<134>%c fortigate.security.test FortiGate: type=event subtype=system action=Edit cfgpath="firewall.policy" cfgobj="12" cfgattr="srcaddr[all]" user="admin" ui="GUI(10.0.0.5)" msg="Edit firewall.policy 12" +<134>%c fortigate.security.test FortiGate: type=event subtype=vpn action=ssl-login-fail severity=warning srcip=203.0.113.50 user="jdoe" reason="sslvpn_login_permission_denied" msg="SSL VPN login failed" +<134>%c fortigate.security.test FortiGate: type=event subtype=system action=login status=failed user="admin" ui="ssh(203.0.113.9)" reason="name_invalid" msg="Administrator admin login failed from ssh(203.0.113.9)" +<134>%c fortigate.security.test FortiGate: type=event subtype=vpn action=tunnel-up srcip=198.51.100.7 user="rsmith" tunnelid=12345 msg="SSL VPN tunnel established"