FortiGate: Alert on Added Firewall Policy via Event Log
Flags FortiGate events where a firewall policy is added (action Add on firewall.policy).
FreeReviewedSigma · Medium · v2
- Product
- fortigate
- Service
- event
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2025-11-01
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags events where a FortiGate firewall policy is added, based on an action value of "Add" tied to the firewall.policy configuration path. Attackers may create new firewall policies to enable unauthorized traffic flows or to bypass existing controls. It relies on FortiGate event telemetry that records configuration changes for firewall policy objects.
Reporting behind it
- fortiguard.comhttps://www.fortiguard.com/psirt/FG-IR-24-535
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
fortigate-new-firewall-policy-added-via-event-logs-f24ab7a8
title: "FortiGate: Alert on Added Firewall Policy via Event Log"
id: caf55b7a-eaf9-4388-af08-8468c9dcf5af
status: experimental
description: This rule flags events where a FortiGate firewall policy is added, based on an action value of "Add" tied to the firewall.policy configuration path. Attackers may create new firewall policies to enable unauthorized traffic flows or to bypass existing controls. It relies on FortiGate event telemetry that records configuration changes for firewall policy objects.
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
modified: 2026-05-04
tags:
- attack.defense-impairment
- attack.t1686.002
logsource:
product: fortigate
service: event
detection:
selection:
action: Add
cfgpath: firewall.policy
condition: selection
falsepositives:
- A firewall policy can be added for legitimate purposes.
level: medium
license: DRL-1.1
related:
- id: f24ab7a8-f09a-4319-82c1-915586aa642b
type: derived