Fortigate OPSEC - monitor your Fortigate for critical events

Alert on specific admin users logging in. You cannot get rid completely of local admin user(s) on the FortiGate (at least I didn’t find the way). For emergency access, you have to have at least a single local user with 𝚜𝚞𝚙𝚎𝚛_𝚊𝚍𝚖𝚒𝚗 privileges. It is recommended to limit such user as much as possible, including setting TrustHost to 127.0.0.1, so this user can only log in from the console. And it is equally important to be alerted if an emergency-only user logs in during non-emergency situations.

Alert on any changes in SYstem → Admin configuration tree. It was born out of necessity – if a FortiGate has multiple admins, no matter how much education you do, admins again and again will add new admins/edit existing ones setting their TrustHost to 0.0.0.0 and opening the Fortigate to brute force attempts or worse, exploitation.

Alert on failed admin users logins. This explains itself – you want to be alerted for timed brute force attacks – when attackers know that default login failure is 3 times, and pace their attempts to evade this time window and not be locked out of further attempts.

Alert on locked out admin users attempts. After (configurable) 3 failed attempts, the source IP will be blocked from accessing the management IP for configurable number of minutes. When this happens, and you see that those attempts are NOT from some caffein-confused admin, then you have the management interface open to the whole Internet or to the wrong IPs, check immediately.

Alert on admins downloading the configuration. When you already have automatic configuration back ups in place (and you should if not), there is no reason to download config manually unless during the upgrade.

Alert on Fortigate disconnecting from FortiAnalyzer. Also, after a case where I had to audit/investigate changes made to the FortiGate and discovered that due to technical issue, this FortiGate had been disconnected from FAZ for few weeks before the events and I had no logs to search.