FortiGate: New Firewall Policy Added via Event Logs

Flags FortiGate events where a firewall policy is added (action Add on firewall.policy).

FreeUnreviewedSigmamediumv1

fortigate-new-firewall-policy-added-via-event-logs-f24ab7a8

title: "FortiGate: New Firewall Policy Added via Event Logs"
id: caf55b7a-eaf9-4388-af08-8468c9dcf5af
status: experimental
description: This rule identifies when a Fortinet FortiGate firewall policy is added, based on an event indicating action "Add" for the firewall.policy configuration path. Attackers and administrators alike can use new firewall policies to enable or expose access paths, so newly created rules are high-signal for defensive monitoring and change review. It relies on FortiGate event log telemetry that records configuration changes, including the action type and config path.
references:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
modified: 2026-05-04
tags:
  - attack.defense-impairment
  - attack.t1686.002
logsource:
  product: fortigate
  service: event
detection:
  selection:
    action: Add
    cfgpath: firewall.policy
  condition: selection
falsepositives:
  - A firewall policy can be added for legitimate purposes.
level: medium
license: DRL-1.1
related:
  - id: f24ab7a8-f09a-4319-82c1-915586aa642b
    type: derived

What it detects

This rule identifies when a Fortinet FortiGate firewall policy is added, based on an event indicating action "Add" for the firewall.policy configuration path. Attackers and administrators alike can use new firewall policies to enable or expose access paths, so newly created rules are high-signal for defensive monitoring and change review. It relies on FortiGate event log telemetry that records configuration changes, including the action type and config path.

Known false positives

A firewall policy can be added for legitimate purposes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.