@cryptotaxi247 / CoPilot / commits / 2ba0d9cf

567 fortinet firewall detection rules (#568)

* feat: add Fortinet alerts to AvailableMonitoringAlerts enum * feat: Add new Fortinet monitoring alerts and provisioning functions - Introduced multiple new monitoring alerts for Fortinet, including: - FortiWeb Path Traversal Vulnerability Exploitation Attempt - WIDS Wireless Valid Client Misassociation Detected - WIDS Wireless Management Flooding Detected - WIDS Wireless EAPOL Packet Flooding Detected - WIDS Rogue Access Point Detected - WIDS Wireless Long Duration Attack Detected - Firewall Virus Detected - WIDS Wireless Threat Detected - WIDS Wireless Invalid MAC OUI Detected - WIDS Wireless Asleap Attack Detected - IPS Malicious URL Detected - IPS Botnet Activity Detected - Admin User Created from Public IP - Suspicious Config File Access from External Network - WIDS Wireless Weak Encryption Detected - Suspicious Super Admin Login Detected - Updated the provisioning functions to handle the new alerts. - Enhanced the schema documentation for Fortinet alerts.

taylor_socfortress committed Dec 19, 2025 at 09:19 UTC 2ba0d9cf34a44fdd3b532bffa102ae4e85817149

4 files changed +1221 -1

.flake8

+1 -1

@@ -1,6 +1,6 @@

1 [flake8]

2 #max-complexity = 18

3 -max-line-length = 202

3 +max-line-length = 270

4 #select = B,C,E,F,W,T4,B9

5 #ignore = E203, E266, E501, W503, F403, F401

6 ignore = E402, W503, E231, W605, E266, E712, E702, E713, E999, E272, E241, E221, E202

backend/app/integrations/monitoring_alert/routes/provision.py

+182

@@ -29,12 +29,60 @@ from app.integrations.monitoring_alert.services.provision import (

29 provision_crowdstrike_monitoring_alert,

30 )

31 from app.integrations.monitoring_alert.services.provision import provision_custom_alert

32 +from app.integrations.monitoring_alert.services.provision import (

33 + provision_fortinet_admin_user_created_from_public_ip_monitoring_alert,

34 +)

35 +from app.integrations.monitoring_alert.services.provision import (

36 + provision_fortinet_firewall_virus_detected_monitoring_alert,

37 +)

38 +from app.integrations.monitoring_alert.services.provision import (

39 + provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert,

40 +)

41 +from app.integrations.monitoring_alert.services.provision import (

42 + provision_fortinet_ips_botnet_activity_detected_monitoring_alert,

43 +)

44 +from app.integrations.monitoring_alert.services.provision import (

45 + provision_fortinet_ips_malicious_url_detected_monitoring_alert,

46 +)

47 +from app.integrations.monitoring_alert.services.provision import (

48 + provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert,

49 +)

50 +from app.integrations.monitoring_alert.services.provision import (

51 + provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert,

52 +)

53 from app.integrations.monitoring_alert.services.provision import (

54 provision_fortinet_system_monitoring_alert,

55 )

56 from app.integrations.monitoring_alert.services.provision import (

57 provision_fortinet_utm_monitoring_alert,

58 )

59 +from app.integrations.monitoring_alert.services.provision import (

60 + provision_fortinet_wids_rogue_access_point_detected_monitoring_alert,

61 +)

62 +from app.integrations.monitoring_alert.services.provision import (

63 + provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert,

64 +)

65 +from app.integrations.monitoring_alert.services.provision import (

66 + provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert,

67 +)

68 +from app.integrations.monitoring_alert.services.provision import (

69 + provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert,

70 +)

71 +from app.integrations.monitoring_alert.services.provision import (

72 + provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert,

73 +)

74 +from app.integrations.monitoring_alert.services.provision import (

75 + provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert,

76 +)

77 +from app.integrations.monitoring_alert.services.provision import (

78 + provision_fortinet_wids_wireless_threat_detected_monitoring_alert,

79 +)

80 +from app.integrations.monitoring_alert.services.provision import (

81 + provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert,

82 +)

83 +from app.integrations.monitoring_alert.services.provision import (

84 + provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert,

85 +)

86 from app.integrations.monitoring_alert.services.provision import (

87 provision_office365_exchange_online_alert,

88 )

@@ -154,6 +202,124 @@ async def invoke_provision_fortinet_utm_monitoring_alert(

202 await provision_fortinet_utm_monitoring_alert(request)

203

204

205 +async def invoke_provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert(

206 + request: ProvisionMonitoringAlertRequest,

207 +):

208 + await provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert(

209 + request,

210 + )

211 +

212 +

213 +async def invoke_provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert(

214 + request: ProvisionMonitoringAlertRequest,

215 +):

216 + await provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert(

217 + request,

218 + )

219 +

220 +

221 +async def invoke_provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert(

222 + request: ProvisionMonitoringAlertRequest,

223 +):

224 + await provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert(

225 + request,

226 + )

227 +

228 +

229 +async def invoke_provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert(

230 + request: ProvisionMonitoringAlertRequest,

231 +):

232 + await provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert(

233 + request,

234 + )

235 +

236 +

237 +async def invoke_provision_fortinet_wids_rogue_access_point_detected_monitoring_alert(

238 + request: ProvisionMonitoringAlertRequest,

239 +):

240 + await provision_fortinet_wids_rogue_access_point_detected_monitoring_alert(

241 + request,

242 + )

243 +

244 +

245 +async def invoke_provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert(

246 + request: ProvisionMonitoringAlertRequest,

247 +):

248 + await provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert(

249 + request,

250 + )

251 +

252 +

253 +async def invoke_provision_fortinet_firewall_virus_detected_monitoring_alert(

254 + request: ProvisionMonitoringAlertRequest,

255 +):

256 + await provision_fortinet_firewall_virus_detected_monitoring_alert(request)

257 +

258 +

259 +async def invoke_provision_fortinet_wids_wireless_threat_detected_monitoring_alert(

260 + request: ProvisionMonitoringAlertRequest,

261 +):

262 + await provision_fortinet_wids_wireless_threat_detected_monitoring_alert(request)

263 +

264 +

265 +async def invoke_provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert(

266 + request: ProvisionMonitoringAlertRequest,

267 +):

268 + await provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert(

269 + request,

270 + )

271 +

272 +

273 +async def invoke_provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert(

274 + request: ProvisionMonitoringAlertRequest,

275 +):

276 + await provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert(

277 + request,

278 + )

279 +

280 +

281 +async def invoke_provision_fortinet_ips_malicious_url_detected_monitoring_alert(

282 + request: ProvisionMonitoringAlertRequest,

283 +):

284 + await provision_fortinet_ips_malicious_url_detected_monitoring_alert(request)

285 +

286 +

287 +async def invoke_provision_fortinet_ips_botnet_activity_detected_monitoring_alert(

288 + request: ProvisionMonitoringAlertRequest,

289 +):

290 + await provision_fortinet_ips_botnet_activity_detected_monitoring_alert(request)

291 +

292 +

293 +async def invoke_provision_fortinet_admin_user_created_from_public_ip_monitoring_alert(

294 + request: ProvisionMonitoringAlertRequest,

295 +):

296 + await provision_fortinet_admin_user_created_from_public_ip_monitoring_alert(request)

297 +

298 +

299 +async def invoke_provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert(

300 + request: ProvisionMonitoringAlertRequest,

301 +):

302 + await provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert(

303 + request,

304 + )

305 +

306 +

307 +async def invoke_provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert(

308 + request: ProvisionMonitoringAlertRequest,

309 +):

310 + await provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert(

311 + request,

312 + )

313 +

314 +

315 +async def invoke_provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert(

316 + request: ProvisionMonitoringAlertRequest,

317 +):

318 + await provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert(

319 + request,

320 + )

321 +

322 +

323 async def invoke_provision_paloalto_monitoring_alert(

324 request: ProvisionMonitoringAlertRequest,

325 ):

@@ -177,6 +343,22 @@ PROVISION_FUNCTIONS = {

343 "CROWDSTRIKE_ALERT": invoke_provision_crowdstrike_monitoring_alert,

344 "FORTINET_SYSTEM": invoke_provision_fortinet_system_monitoring_alert,

345 "FORTINET_UTM": invoke_provision_fortinet_utm_monitoring_alert,

346 + "FORTINET_FORTIWEB_PATH_TRAVERSAL_VULNERABILITY_EXPLOITATION_ATTEMPT": invoke_provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert,

347 + "FORTINET_WIDS_WIRELESS_VALID_CLIENT_MISASSOCIATION_DETECTED": invoke_provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert,

348 + "FORTINET_WIDS_WIRELESS_MANAGEMENT_FLOODING_DETECTED": invoke_provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert,

349 + "FORTINET_WIDS_WIRELESS_EAPOL_PACKET_FLOODING_DETECTED": invoke_provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert,

350 + "FORTINET_WIDS_ROGUE_ACCESS_POINT_DETECTED": invoke_provision_fortinet_wids_rogue_access_point_detected_monitoring_alert,

351 + "FORTINET_WIDS_WIRELESS_LONG_DURATION_ATTACK_DETECTED": invoke_provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert,

352 + "FORTINET_FIREWALL_VIRUS_DETECTED": invoke_provision_fortinet_firewall_virus_detected_monitoring_alert,

353 + "FORTINET_WIDS_WIRELESS_THREAT_DETECTED": invoke_provision_fortinet_wids_wireless_threat_detected_monitoring_alert,

354 + "FORTINET_WIDS_WIRELESS_INVALID_MAC_OUI_DETECTED": invoke_provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert,

355 + "FORTINET_WIDS_WIRELESS_ASLEAP_ATTACK_DETECTED": invoke_provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert,

356 + "FORTINET_IPS_MALICIOUS_URL_DETECTED": invoke_provision_fortinet_ips_malicious_url_detected_monitoring_alert,

357 + "FORTINET_IPS_BOTNET_ACTIVITY_DETECTED": invoke_provision_fortinet_ips_botnet_activity_detected_monitoring_alert,

358 + "FORTINET_ADMIN_USER_CREATED_FROM_PUBLIC_IP": invoke_provision_fortinet_admin_user_created_from_public_ip_monitoring_alert,

359 + "FORTINET_SUSPICIOUS_CONFIG_FILE_ACCESS_FROM_EXTERNAL_NETWORK": invoke_provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert,

360 + "FORTINET_WIDS_WIRELESS_WEAK_ENCRYPTION_DETECTED": invoke_provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert,

361 + "FORTINET_SUSPICIOUS_SUPER_ADMIN_LOGIN_DETECTED": invoke_provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert,

362 "PALOALTO_ALERT": invoke_provision_paloalto_monitoring_alert,

363 "CUSTOM": invoke_provision_custom_monitoring_alert,

364 # Add more alert names and functions as needed

backend/app/integrations/monitoring_alert/schema/provision.py

+123

@@ -38,6 +38,7 @@ class AvailableMonitoringAlerts(str, Enum):

38 "alert that is created within CoPilot. Ensure that you have a pipeline rule that sets the "

39 "alert_severity field to 1 when the CrowdStrike alert is detected."

40 )

41 + # ! --- Fortinet / FortiGate alerts ---

42 FORTINET_SYSTEM = (

43 "This alert monitors the Fortinet System events. When an alert is detected, it triggers an "

44 "alert that is created within CoPilot. Ensure that you have a pipeline rule that sets the "

@@ -48,6 +49,128 @@ class AvailableMonitoringAlerts(str, Enum):

49 "alert that is created within CoPilot. Ensure that you have a pipeline rule that sets the "

50 "alert_severity field to 1 when the Fortinet alert is detected."

51 )

52 + FORTINET_FORTIWEB_PATH_TRAVERSAL_VULNERABILITY_EXPLOITATION_ATTEMPT = (

53 + "Detects potential exploitation attempts targeting CVE-2025-64446, a critical path traversal vulnerability "

54 + "affecting Fortinet FortiWeb Web Application Firewalls (WAF). "

55 + "An adversary can abuse this flaw, which requires no authentication, to create new, unauthorized "

56 + "administrative user accounts on the exposed device. "

57 + "This provides the threat actor with full administrative control over the security appliance, allowing "

58 + "them to bypass security policies, neutralize the WAF, and establish a persistent backdoor for further "

59 + "network intrusions."

60 + )

61 + FORTINET_WIDS_WIRELESS_VALID_CLIENT_MISASSOCIATION_DETECTED = (

62 + "Detects when FortiGate Wireless IDS identifies an incident where a legitimate wireless client associates "

63 + "with a rogue or unauthorized access point (AP), a behavior known as valid client misassociation. "

64 + "Attackers may set up malicious APs to impersonate trusted networks, tricking legitimate clients into "

65 + "connecting. "

66 + "This tactic is commonly used in evil twin attacks to intercept traffic, harvest credentials, or inject "

67 + "malicious payloads. Identifying such associations is essential to safeguarding wireless network integrity "

68 + "and preventing data leakage."

69 + )

70 + FORTINET_WIDS_WIRELESS_MANAGEMENT_FLOODING_DETECTED = (

71 + "Detects when FortiGate Wireless IDS identifies abnormal surges of wireless management frames, such as "

72 + "authentication, association, or probe requests, which may indicate a management frame flooding attack. "

73 + "Adversaries use this technique to disrupt wireless network operations, exhaust access point resources, or "

74 + "perform denial-of-service (DoS) attacks. "

75 + "Continuous monitoring of management frame activity helps with the early identification and mitigation of "

76 + "wireless network disruptions."

77 + )

78 + FORTINET_WIDS_WIRELESS_EAPOL_PACKET_FLOODING_DETECTED = (

79 + "Detects a flood of EAPOL (Extensible Authentication Protocol over LAN) packets on the wireless network "

80 + "identified by FortiGate Wireless IDS. "

81 + "Such flooding can exhaust network resources, disrupt normal authentication processes, or exploit "

82 + "weaknesses in WPA/WPA2 handshakes. "

83 + "Monitoring for this behavior is crucial to maintaining secure and stable wireless authentication services "

84 + "in enterprise environments."

85 + )

86 + FORTINET_WIDS_ROGUE_ACCESS_POINT_DETECTED = (

87 + "Detects the rogue access point (AP) in the network as reported by FortiGate Wireless IDS. "

88 + "Rogue APs are unauthorized wireless access points connected to a network, often used by attackers to "

89 + "bypass security controls, capture sensitive data, or conduct man-in-the-middle attacks. "

90 + "Detection of rogue APs is critical to maintaining wireless network integrity and preventing unauthorized "

91 + "access."

92 + )

93 + FORTINET_WIDS_WIRELESS_LONG_DURATION_ATTACK_DETECTED = (

94 + "Detects a long duration attack on the wireless network identified by FortiGate Wireless IDS. "

95 + "These attacks often involve persistent connections to rogue access points or the use of compromised "

96 + "clients to maintain unauthorized access over an extended period. "

97 + "Such activity may be used by adversaries for sustained data exfiltration, network reconnaissance, or to "

98 + "establish footholds in the environment. "

99 + "Monitoring these patterns is crucial to detecting stealthy and persistent wireless threats."

100 + )

101 + FORTINET_FIREWALL_VIRUS_DETECTED = (

102 + "Detects the virus in the network identified by FortiGate Firewall. "

103 + "This may indicate the presence of malware or a malicious file attempting to execute or transfer within "

104 + "the network. "

105 + "Threat actors may use malware to gain access, maintain persistence, or exfiltrate data. Monitoring such "

106 + "events can help identify compromised systems or prevent further infection spread."

107 + )

108 + FORTINET_WIDS_WIRELESS_THREAT_DETECTED = (

109 + "Detects potential wireless-based security threats as identified by FortiGate Wireless IDS. "

110 + "These threats may include spoofed access points, EAPOL flooding, deauthentication attacks, or other "

111 + "suspicious wireless behaviors. "

112 + "Monitoring such events is critical to protecting against wireless intrusion attempts, maintaining the "

113 + "integrity of the Wi-Fi network, and preventing unauthorized access or denial-of-service conditions caused "

114 + "by malicious actors."

115 + )

116 + FORTINET_WIDS_WIRELESS_INVALID_MAC_OUI_DETECTED = (

117 + "Detects instances where a FortiGate Wireless IDS identifies a client with an invalid or unrecognized MAC "

118 + "Organizationally Unique Identifier (OUI). "

119 + "This may indicate the presence of unauthorized, rogue, or potentially malicious devices attempting to "

120 + "connect to the wireless network. "

121 + "Monitoring for invalid MAC OUIs helps strengthen network access controls and prevent unauthorized access."

122 + )

123 + FORTINET_WIDS_WIRELESS_ASLEAP_ATTACK_DETECTED = (

124 + "Detects the presence of an Asleap attack in a wireless network identified by FortiGate Wireless IDS. "

125 + "Asleap is a tool used to exploit weak authentication in LEAP (Lightweight Extensible Authentication "

126 + "Protocol), potentially allowing attackers to capture and crack wireless credentials. "

127 + "Monitoring for this activity helps identify unauthorized attempts to compromise wireless network security "

128 + "and protect sensitive credentials."

129 + )

130 + FORTINET_IPS_MALICIOUS_URL_DETECTED = (

131 + "Detects when FortiGate Intrusion Prevention System (IPS) identifies access to a known malicious URL. "

132 + "This activity may indicate attempts to connect to command and control infrastructure, deliver malware, or "

133 + "exfiltrate data. "

134 + "Monitoring these detections helps identify potential threats, prevent compromise, and maintain network "

135 + "security."

136 + )

137 + FORTINET_IPS_BOTNET_ACTIVITY_DETECTED = (

138 + "Detects botnet-related activity identified by FortiGate Intrusion Prevention System (IPS). This may "

139 + "indicate that a host within the network is communicating with known botnet command and control servers or "

140 + "exhibiting behavior consistent with botnet infections. Monitoring these events helps identify compromised "

141 + "systems, prevent data exfiltration, and mitigate the spread of malicious activity within the environment."

142 + )

143 + FORTINET_ADMIN_USER_CREATED_FROM_PUBLIC_IP = (

144 + "Detects the creation of a new administrator user account on a Fortinet FortiGate device originating from "

145 + "a public IP address. "

146 + "An adversary who gains access to the management interface may create unauthorized admin accounts to "

147 + "establish persistent, privileged control over the firewall. "

148 + "By creating these accounts from external or atypical network locations, attackers can maintain long-term "

149 + "access, modify security policies, exfiltrate sensitive data, or prepare the environment for additional "

150 + "malicious activity."

151 + )

152 + FORTINET_SUSPICIOUS_CONFIG_FILE_ACCESS_FROM_EXTERNAL_NETWORK = (

153 + "Detects attempts to download a FortiGate configuration file from an external or publicly accessible "

154 + "network source. "

155 + "Adversaries may abuse this behavior to obtain sensitive configuration data, including administrative "

156 + "credentials, network topology details, VPN settings, or firewall policies. "

157 + "Access to this information can enable further compromise through targeted lateral movement, privilege "

158 + "escalation, or tailored exploitation of exposed services."

159 + )

160 + FORTINET_WIDS_WIRELESS_WEAK_ENCRYPTION_DETECTED = (

161 + "Detects wireless access points using weak or deprecated encryption protocols, as reported by FortiGate "

162 + "Wireless IDS. "

163 + "Risky encryption methods, such as WEP or misconfigured WPA settings, may allow adversaries to eavesdrop "

164 + "on network traffic or perform cryptographic attacks to gain unauthorized access. "

165 + "Identifying and remediating such vulnerabilities is essential to ensure wireless network confidentiality "

166 + "and compliance with security best practices."

167 + )

168 + FORTINET_SUSPICIOUS_SUPER_ADMIN_LOGIN_DETECTED = (

169 + "Detects a super admin login attempt to a FortiGate firewall originating from a suspicious or public IP "

170 + "address. "

171 + "This may indicate an attempt to exploit CVE-2025-24472 which allows unauthenticated attackers to gain "

172 + "super admin privileges on vulnerable FortiOS devices (<7.0.16) with exposed management interfaces."

173 + )

174 PALOALTO_ALERT = (

175 "This alert monitors the PaloAlto events. When an alert is detected, it triggers an "

176 "alert that is created within CoPilot. Ensure that you have a pipeline rule that sets the "

backend/app/integrations/monitoring_alert/services/provision.py

+915

@@ -947,6 +947,921 @@ async def provision_fortinet_utm_monitoring_alert(

947 )

948

949

950 +async def provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert(

951 + request: ProvisionMonitoringAlertRequest,

952 +) -> ProvisionWazuhMonitoringAlertResponse:

953 + """

954 + Provisions Fortinet FortiWeb Path Traversal Vulnerability Exploitation Attempt monitoring alert.

955 + """

956 + logger.info(

957 + "Invoking provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert "

958 + f"with request: {request.dict()}",

959 + )

960 + await provision_alert_definition(

961 + GraylogAlertProvisionModel(

962 + title="FORTINET - FORTIWEB PATH TRAVERSAL VULNERABILITY EXPLOITATION ATTEMPT",

963 + description="FORTINET - FORTIWEB PATH TRAVERSAL VULNERABILITY EXPLOITATION ATTEMPT",

964 + priority=2,

965 + config=GraylogAlertProvisionConfig(

966 + type="aggregation-v1",

967 + query=r"syslog_type:fortinet AND httpmethod:POST AND !action:blocked AND !action:block AND !action:reset AND !action:drop AND !action:dropped AND (url:/\/system\/admin%3F/ OR url:/\/cgi\-bin\/fwbcgi/)",

968 + query_parameters=[],

969 + streams=[],

970 + group_by=[],

971 + series=[],

972 + conditions={"expression": None},

973 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

974 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

975 + event_limit=1000,

976 + ),

977 + field_spec={

978 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

979 + data_type="string",

980 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

981 + ),

982 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

983 + data_type="string",

984 + providers=[

985 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

986 + ],

987 + ),

988 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

989 + data_type="string",

990 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

991 + ),

992 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

993 + data_type="string",

994 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

995 + ),

996 + },

997 + key_spec=[],

998 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

999 + alert=True,

1000 + ),

1001 + )

1002 + return ProvisionWazuhMonitoringAlertResponse(

1003 + success=True,

1004 + message="Fortinet FortiWeb path traversal vulnerability exploitation attempt monitoring alert provisioned successfully",

1005 + )

1006 +

1007 +

1008 +async def provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert(

1009 + request: ProvisionMonitoringAlertRequest,

1010 +) -> ProvisionWazuhMonitoringAlertResponse:

1011 + """

1012 + Provisions Fortinet WIDS Wireless Valid Client Misassociation Detected monitoring alert.

1013 + """

1014 + logger.info(

1015 + "Invoking provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert "

1016 + f"with request: {request.dict()}",

1017 + )

1018 + await provision_alert_definition(

1019 + GraylogAlertProvisionModel(

1020 + title="FORTINET - WIDS WIRELESS VALID CLIENT MISASSOCIATION DETECTED",

1021 + description="FORTINET - WIDS WIRELESS VALID CLIENT MISASSOCIATION DETECTED",

1022 + priority=2,

1023 + config=GraylogAlertProvisionConfig(

1024 + type="aggregation-v1",

1025 + query='syslog_type:fortinet AND logdesc:"Wireless valid_client_misassoc detected"',

1026 + query_parameters=[],

1027 + streams=[],

1028 + group_by=[],

1029 + series=[],

1030 + conditions={"expression": None},

1031 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1032 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1033 + event_limit=1000,

1034 + ),

1035 + field_spec={

1036 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1037 + data_type="string",

1038 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1039 + ),

1040 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1041 + data_type="string",

1042 + providers=[

1043 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1044 + ],

1045 + ),

1046 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1047 + data_type="string",

1048 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1049 + ),

1050 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1051 + data_type="string",

1052 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1053 + ),

1054 + },

1055 + key_spec=[],

1056 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1057 + alert=True,

1058 + ),

1059 + )

1060 + return ProvisionWazuhMonitoringAlertResponse(

1061 + success=True,

1062 + message="Fortinet WIDS wireless valid client misassociation detected monitoring alert provisioned successfully",

1063 + )

1064 +

1065 +

1066 +async def provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert(

1067 + request: ProvisionMonitoringAlertRequest,

1068 +) -> ProvisionWazuhMonitoringAlertResponse:

1069 + """

1070 + Provisions Fortinet WIDS Wireless Management Flooding Detected monitoring alert.

1071 + """

1072 + logger.info(

1073 + "Invoking provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert " f"with request: {request.dict()}",

1074 + )

1075 + await provision_alert_definition(

1076 + GraylogAlertProvisionModel(

1077 + title="FORTINET - WIDS WIRELESS MANAGEMENT FLOODING DETECTED",

1078 + description="FORTINET - WIDS WIRELESS MANAGEMENT FLOODING DETECTED",

1079 + priority=2,

1080 + config=GraylogAlertProvisionConfig(

1081 + type="aggregation-v1",

1082 + query='syslog_type:fortinet AND logdesc:"Wireless management flooding detected"',

1083 + query_parameters=[],

1084 + streams=[],

1085 + group_by=[],

1086 + series=[],

1087 + conditions={"expression": None},

1088 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1089 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1090 + event_limit=1000,

1091 + ),

1092 + field_spec={

1093 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1094 + data_type="string",

1095 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1096 + ),

1097 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1098 + data_type="string",

1099 + providers=[

1100 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1101 + ],

1102 + ),

1103 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1104 + data_type="string",

1105 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1106 + ),

1107 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1108 + data_type="string",

1109 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1110 + ),

1111 + },

1112 + key_spec=[],

1113 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1114 + alert=True,

1115 + ),

1116 + )

1117 + return ProvisionWazuhMonitoringAlertResponse(

1118 + success=True,

1119 + message="Fortinet WIDS wireless management flooding detected monitoring alert provisioned successfully",

1120 + )

1121 +

1122 +

1123 +async def provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert(

1124 + request: ProvisionMonitoringAlertRequest,

1125 +) -> ProvisionWazuhMonitoringAlertResponse:

1126 + """

1127 + Provisions Fortinet WIDS Wireless EAPOL Packet Flooding Detected monitoring alert.

1128 + """

1129 + logger.info(

1130 + "Invoking provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert " f"with request: {request.dict()}",

1131 + )

1132 + await provision_alert_definition(

1133 + GraylogAlertProvisionModel(

1134 + title="FORTINET - WIDS WIRELESS EAPOL PACKET FLOODING DETECTED",

1135 + description="FORTINET - WIDS WIRELESS EAPOL PACKET FLOODING DETECTED",

1136 + priority=2,

1137 + config=GraylogAlertProvisionConfig(

1138 + type="aggregation-v1",

1139 + query='syslog_type:fortinet AND logdesc:"Wireless EAPOL packet flooding detected"',

1140 + query_parameters=[],

1141 + streams=[],

1142 + group_by=[],

1143 + series=[],

1144 + conditions={"expression": None},

1145 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1146 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1147 + event_limit=1000,

1148 + ),

1149 + field_spec={

1150 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1151 + data_type="string",

1152 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1153 + ),

1154 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1155 + data_type="string",

1156 + providers=[

1157 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1158 + ],

1159 + ),

1160 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1161 + data_type="string",

1162 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1163 + ),

1164 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1165 + data_type="string",

1166 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1167 + ),

1168 + },

1169 + key_spec=[],

1170 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1171 + alert=True,

1172 + ),

1173 + )

1174 + return ProvisionWazuhMonitoringAlertResponse(

1175 + success=True,

1176 + message="Fortinet WIDS wireless EAPOL packet flooding detected monitoring alert provisioned successfully",

1177 + )

1178 +

1179 +

1180 +async def provision_fortinet_wids_rogue_access_point_detected_monitoring_alert(

1181 + request: ProvisionMonitoringAlertRequest,

1182 +) -> ProvisionWazuhMonitoringAlertResponse:

1183 + """

1184 + Provisions Fortinet WIDS Rogue Access Point Detected monitoring alert.

1185 + """

1186 + logger.info(

1187 + "Invoking provision_fortinet_wids_rogue_access_point_detected_monitoring_alert " f"with request: {request.dict()}",

1188 + )

1189 + await provision_alert_definition(

1190 + GraylogAlertProvisionModel(

1191 + title="FORTINET - WIDS ROGUE ACCESS POINT DETECTED",

1192 + description="FORTINET - WIDS ROGUE ACCESS POINT DETECTED",

1193 + priority=2,

1194 + config=GraylogAlertProvisionConfig(

1195 + type="aggregation-v1",

1196 + query='syslog_type:fortinet AND (logdesc:"Rogue AP detected" OR logdesc:"Rogue AP activity" OR logdesc:"Rogue AP on air" OR logdesc:"Fake AP on air" OR logdesc:"Fake AP detected" OR logdesc:"Offending AP on air" OR logdesc:"Offending AP detected")',

1197 + query_parameters=[],

1198 + streams=[],

1199 + group_by=[],

1200 + series=[],

1201 + conditions={"expression": None},

1202 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1203 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1204 + event_limit=1000,

1205 + ),

1206 + field_spec={

1207 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1208 + data_type="string",

1209 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1210 + ),

1211 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1212 + data_type="string",

1213 + providers=[

1214 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1215 + ],

1216 + ),

1217 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1218 + data_type="string",

1219 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1220 + ),

1221 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1222 + data_type="string",

1223 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1224 + ),

1225 + },

1226 + key_spec=[],

1227 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1228 + alert=True,

1229 + ),

1230 + )

1231 + return ProvisionWazuhMonitoringAlertResponse(

1232 + success=True,

1233 + message="Fortinet WIDS rogue access point detected monitoring alert provisioned successfully",

1234 + )

1235 +

1236 +

1237 +async def provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert(

1238 + request: ProvisionMonitoringAlertRequest,

1239 +) -> ProvisionWazuhMonitoringAlertResponse:

1240 + """

1241 + Provisions Fortinet WIDS Wireless Long Duration Attack Detected monitoring alert.

1242 + """

1243 + logger.info(

1244 + "Invoking provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert " f"with request: {request.dict()}",

1245 + )

1246 + await provision_alert_definition(

1247 + GraylogAlertProvisionModel(

1248 + title="FORTINET - WIDS WIRELESS LONG DURATION ATTACK DETECTED",

1249 + description="FORTINET - WIDS WIRELESS LONG DURATION ATTACK DETECTED",

1250 + priority=2,

1251 + config=GraylogAlertProvisionConfig(

1252 + type="aggregation-v1",

1253 + query='syslog_type:fortinet AND logdesc:"Wireless long duration attack detected"',

1254 + query_parameters=[],

1255 + streams=[],

1256 + group_by=[],

1257 + series=[],

1258 + conditions={"expression": None},

1259 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1260 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1261 + event_limit=1000,

1262 + ),

1263 + field_spec={

1264 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1265 + data_type="string",

1266 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1267 + ),

1268 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1269 + data_type="string",

1270 + providers=[

1271 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1272 + ],

1273 + ),

1274 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1275 + data_type="string",

1276 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1277 + ),

1278 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1279 + data_type="string",

1280 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1281 + ),

1282 + },

1283 + key_spec=[],

1284 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1285 + alert=True,

1286 + ),

1287 + )

1288 + return ProvisionWazuhMonitoringAlertResponse(

1289 + success=True,

1290 + message="Fortinet WIDS wireless long duration attack detected monitoring alert provisioned successfully",

1291 + )

1292 +

1293 +

1294 +async def provision_fortinet_firewall_virus_detected_monitoring_alert(

1295 + request: ProvisionMonitoringAlertRequest,

1296 +) -> ProvisionWazuhMonitoringAlertResponse:

1297 + """

1298 + Provisions Fortinet Firewall Virus Detected monitoring alert.

1299 + """

1300 + logger.info(

1301 + "Invoking provision_fortinet_firewall_virus_detected_monitoring_alert " f"with request: {request.dict()}",

1302 + )

1303 + await provision_alert_definition(

1304 + GraylogAlertProvisionModel(

1305 + title="FORTINET - FIREWALL VIRUS DETECTED",

1306 + description="FORTINET - FIREWALL VIRUS DETECTED",

1307 + priority=2,

1308 + config=GraylogAlertProvisionConfig(

1309 + type="aggregation-v1",

1310 + query='syslog_type:fortinet AND subtype:"virus" AND !action:"blocked"',

1311 + query_parameters=[],

1312 + streams=[],

1313 + group_by=[],

1314 + series=[],

1315 + conditions={"expression": None},

1316 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1317 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1318 + event_limit=1000,

1319 + ),

1320 + field_spec={

1321 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1322 + data_type="string",

1323 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1324 + ),

1325 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1326 + data_type="string",

1327 + providers=[

1328 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1329 + ],

1330 + ),

1331 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1332 + data_type="string",

1333 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1334 + ),

1335 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1336 + data_type="string",

1337 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1338 + ),

1339 + },

1340 + key_spec=[],

1341 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1342 + alert=True,

1343 + ),

1344 + )

1345 + return ProvisionWazuhMonitoringAlertResponse(

1346 + success=True,

1347 + message="Fortinet firewall virus detected monitoring alert provisioned successfully",

1348 + )

1349 +

1350 +

1351 +async def provision_fortinet_wids_wireless_threat_detected_monitoring_alert(

1352 + request: ProvisionMonitoringAlertRequest,

1353 +) -> ProvisionWazuhMonitoringAlertResponse:

1354 + """

1355 + Provisions Fortinet WIDS Wireless Threat Detected monitoring alert.

1356 + """

1357 + logger.info(

1358 + "Invoking provision_fortinet_wids_wireless_threat_detected_monitoring_alert " f"with request: {request.dict()}",

1359 + )

1360 + await provision_alert_definition(

1361 + GraylogAlertProvisionModel(

1362 + title="FORTINET - WIDS WIRELESS THREAT DETECTED",

1363 + description="FORTINET - WIDS WIRELESS THREAT DETECTED",

1364 + priority=2,

1365 + config=GraylogAlertProvisionConfig(

1366 + type="aggregation-v1",

1367 + query='syslog_type:fortinet AND logdesc:"Wireless threat detected"',

1368 + query_parameters=[],

1369 + streams=[],

1370 + group_by=[],

1371 + series=[],

1372 + conditions={"expression": None},

1373 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1374 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1375 + event_limit=1000,

1376 + ),

1377 + field_spec={

1378 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1379 + data_type="string",

1380 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1381 + ),

1382 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1383 + data_type="string",

1384 + providers=[

1385 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1386 + ],

1387 + ),

1388 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1389 + data_type="string",

1390 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1391 + ),

1392 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1393 + data_type="string",

1394 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1395 + ),

1396 + },

1397 + key_spec=[],

1398 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1399 + alert=True,

1400 + ),

1401 + )

1402 + return ProvisionWazuhMonitoringAlertResponse(

1403 + success=True,

1404 + message="Fortinet WIDS wireless threat detected monitoring alert provisioned successfully",

1405 + )

1406 +

1407 +

1408 +async def provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert(

1409 + request: ProvisionMonitoringAlertRequest,

1410 +) -> ProvisionWazuhMonitoringAlertResponse:

1411 + """

1412 + Provisions Fortinet WIDS Wireless Invalid MAC OUI Detected monitoring alert.

1413 + """

1414 + logger.info(

1415 + "Invoking provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert " f"with request: {request.dict()}",

1416 + )

1417 + await provision_alert_definition(

1418 + GraylogAlertProvisionModel(

1419 + title="FORTINET - WIDS WIRELESS INVALID MAC OUI DETECTED",

1420 + description="FORTINET - WIDS WIRELESS INVALID MAC OUI DETECTED",

1421 + priority=2,

1422 + config=GraylogAlertProvisionConfig(

1423 + type="aggregation-v1",

1424 + query='syslog_type:fortinet AND logdesc:"Wireless invalid MAC OUI detected"',

1425 + query_parameters=[],

1426 + streams=[],

1427 + group_by=[],

1428 + series=[],

1429 + conditions={"expression": None},

1430 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1431 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1432 + event_limit=1000,

1433 + ),

1434 + field_spec={

1435 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1436 + data_type="string",

1437 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1438 + ),

1439 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1440 + data_type="string",

1441 + providers=[

1442 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1443 + ],

1444 + ),

1445 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1446 + data_type="string",

1447 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1448 + ),

1449 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1450 + data_type="string",

1451 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1452 + ),

1453 + },

1454 + key_spec=[],

1455 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1456 + alert=True,

1457 + ),

1458 + )

1459 + return ProvisionWazuhMonitoringAlertResponse(

1460 + success=True,

1461 + message="Fortinet WIDS wireless invalid MAC OUI detected monitoring alert provisioned successfully",

1462 + )

1463 +

1464 +

1465 +async def provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert(

1466 + request: ProvisionMonitoringAlertRequest,

1467 +) -> ProvisionWazuhMonitoringAlertResponse:

1468 + """

1469 + Provisions Fortinet WIDS Wireless Asleap Attack Detected monitoring alert.

1470 + """

1471 + logger.info(

1472 + "Invoking provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert " f"with request: {request.dict()}",

1473 + )

1474 + await provision_alert_definition(

1475 + GraylogAlertProvisionModel(

1476 + title="FORTINET - WIDS WIRELESS ASLEAP ATTACK DETECTED",

1477 + description="FORTINET - WIDS WIRELESS ASLEAP ATTACK DETECTED",

1478 + priority=2,

1479 + config=GraylogAlertProvisionConfig(

1480 + type="aggregation-v1",

1481 + query='syslog_type:fortinet AND logdesc:"Wireless Asleap attack detected"',

1482 + query_parameters=[],

1483 + streams=[],

1484 + group_by=[],

1485 + series=[],

1486 + conditions={"expression": None},

1487 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1488 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1489 + event_limit=1000,

1490 + ),

1491 + field_spec={

1492 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1493 + data_type="string",

1494 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1495 + ),

1496 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1497 + data_type="string",

1498 + providers=[

1499 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1500 + ],

1501 + ),

1502 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1503 + data_type="string",

1504 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1505 + ),

1506 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1507 + data_type="string",

1508 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1509 + ),

1510 + },

1511 + key_spec=[],

1512 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1513 + alert=True,

1514 + ),

1515 + )

1516 + return ProvisionWazuhMonitoringAlertResponse(

1517 + success=True,

1518 + message="Fortinet WIDS wireless Asleap attack detected monitoring alert provisioned successfully",

1519 + )

1520 +

1521 +

1522 +async def provision_fortinet_ips_malicious_url_detected_monitoring_alert(

1523 + request: ProvisionMonitoringAlertRequest,

1524 +) -> ProvisionWazuhMonitoringAlertResponse:

1525 + """

1526 + Provisions Fortinet IPS Malicious URL Detected monitoring alert.

1527 + """

1528 + logger.info(

1529 + "Invoking provision_fortinet_ips_malicious_url_detected_monitoring_alert " f"with request: {request.dict()}",

1530 + )

1531 + await provision_alert_definition(

1532 + GraylogAlertProvisionModel(

1533 + title="FORTINET - IPS MALICIOUS URL DETECTED",

1534 + description="FORTINET - IPS MALICIOUS URL DETECTED",

1535 + priority=2,

1536 + config=GraylogAlertProvisionConfig(

1537 + type="aggregation-v1",

1538 + query='syslog_type:fortinet AND subtype:"ips" AND attack:"malicious-url" AND action:"detected"',

1539 + query_parameters=[],

1540 + streams=[],

1541 + group_by=[],

1542 + series=[],

1543 + conditions={"expression": None},

1544 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1545 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1546 + event_limit=1000,

1547 + ),

1548 + field_spec={

1549 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1550 + data_type="string",

1551 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1552 + ),

1553 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1554 + data_type="string",

1555 + providers=[

1556 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1557 + ],

1558 + ),

1559 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1560 + data_type="string",

1561 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1562 + ),

1563 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1564 + data_type="string",

1565 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1566 + ),

1567 + },

1568 + key_spec=[],

1569 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1570 + alert=True,

1571 + ),

1572 + )

1573 + return ProvisionWazuhMonitoringAlertResponse(

1574 + success=True,

1575 + message="Fortinet IPS malicious URL detected monitoring alert provisioned successfully",

1576 + )

1577 +

1578 +

1579 +async def provision_fortinet_ips_botnet_activity_detected_monitoring_alert(

1580 + request: ProvisionMonitoringAlertRequest,

1581 +) -> ProvisionWazuhMonitoringAlertResponse:

1582 + """

1583 + Provisions Fortinet IPS Botnet Activity Detected monitoring alert.

1584 + """

1585 + logger.info(

1586 + "Invoking provision_fortinet_ips_botnet_activity_detected_monitoring_alert " f"with request: {request.dict()}",

1587 + )

1588 + await provision_alert_definition(

1589 + GraylogAlertProvisionModel(

1590 + title="FORTINET - IPS BOTNET ACTIVITY DETECTED",

1591 + description="FORTINET - IPS BOTNET ACTIVITY DETECTED",

1592 + priority=2,

1593 + config=GraylogAlertProvisionConfig(

1594 + type="aggregation-v1",

1595 + query='syslog_type:fortinet AND subtype:"ips" AND attack:"botnet" AND action:"detected"',

1596 + query_parameters=[],

1597 + streams=[],

1598 + group_by=[],

1599 + series=[],

1600 + conditions={"expression": None},

1601 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1602 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1603 + event_limit=1000,

1604 + ),

1605 + field_spec={

1606 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1607 + data_type="string",

1608 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1609 + ),

1610 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1611 + data_type="string",

1612 + providers=[

1613 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1614 + ],

1615 + ),

1616 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1617 + data_type="string",

1618 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1619 + ),

1620 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1621 + data_type="string",

1622 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1623 + ),

1624 + },

1625 + key_spec=[],

1626 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1627 + alert=True,

1628 + ),

1629 + )

1630 + return ProvisionWazuhMonitoringAlertResponse(

1631 + success=True,

1632 + message="Fortinet IPS botnet activity detected monitoring alert provisioned successfully",

1633 + )

1634 +

1635 +

1636 +async def provision_fortinet_admin_user_created_from_public_ip_monitoring_alert(

1637 + request: ProvisionMonitoringAlertRequest,

1638 +) -> ProvisionWazuhMonitoringAlertResponse:

1639 + """

1640 + Provisions Fortinet Admin User Created from Public IP monitoring alert.

1641 + """

1642 + logger.info(

1643 + "Invoking provision_fortinet_admin_user_created_from_public_ip_monitoring_alert " f"with request: {request.dict()}",

1644 + )

1645 + await provision_alert_definition(

1646 + GraylogAlertProvisionModel(

1647 + title="FORTINET - ADMIN USER CREATED FROM PUBLIC IP",

1648 + description="FORTINET - ADMIN USER CREATED FROM PUBLIC IP",

1649 + priority=2,

1650 + config=GraylogAlertProvisionConfig(

1651 + type="aggregation-v1",

1652 + query='syslog_type:fortinet AND subtype:"system" AND logdesc:"Object attribute configured" AND action:"Add" AND cfgpath:"system.admin"',

1653 + query_parameters=[],

1654 + streams=[],

1655 + group_by=[],

1656 + series=[],

1657 + conditions={"expression": None},

1658 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1659 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1660 + event_limit=1000,

1661 + ),

1662 + field_spec={

1663 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1664 + data_type="string",

1665 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1666 + ),

1667 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1668 + data_type="string",

1669 + providers=[

1670 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1671 + ],

1672 + ),

1673 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1674 + data_type="string",

1675 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1676 + ),

1677 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1678 + data_type="string",

1679 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1680 + ),

1681 + },

1682 + key_spec=[],

1683 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1684 + alert=True,

1685 + ),

1686 + )

1687 + return ProvisionWazuhMonitoringAlertResponse(

1688 + success=True,

1689 + message="Fortinet admin user created from public IP monitoring alert provisioned successfully",

1690 + )

1691 +

1692 +

1693 +async def provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert(

1694 + request: ProvisionMonitoringAlertRequest,

1695 +) -> ProvisionWazuhMonitoringAlertResponse:

1696 + """

1697 + Provisions Fortinet Suspicious Config File Access from External Network monitoring alert.

1698 + """

1699 + logger.info(

1700 + "Invoking provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert "

1701 + f"with request: {request.dict()}",

1702 + )

1703 + await provision_alert_definition(

1704 + GraylogAlertProvisionModel(

1705 + title="FORTINET - SUSPICIOUS CONFIG FILE ACCESS FROM EXTERNAL NETWORK",

1706 + description="FORTINET - SUSPICIOUS CONFIG FILE ACCESS FROM EXTERNAL NETWORK",

1707 + priority=2,

1708 + config=GraylogAlertProvisionConfig(

1709 + type="aggregation-v1",

1710 + query='syslog_type:fortinet AND msg:"System config file has been downloaded" AND status:"success"',

1711 + query_parameters=[],

1712 + streams=[],

1713 + group_by=[],

1714 + series=[],

1715 + conditions={"expression": None},

1716 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1717 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1718 + event_limit=1000,

1719 + ),

1720 + field_spec={

1721 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1722 + data_type="string",

1723 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1724 + ),

1725 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1726 + data_type="string",

1727 + providers=[

1728 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1729 + ],

1730 + ),

1731 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1732 + data_type="string",

1733 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1734 + ),

1735 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1736 + data_type="string",

1737 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1738 + ),

1739 + },

1740 + key_spec=[],

1741 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1742 + alert=True,

1743 + ),

1744 + )

1745 + return ProvisionWazuhMonitoringAlertResponse(

1746 + success=True,

1747 + message="Fortinet suspicious config file access from external network monitoring alert provisioned successfully",

1748 + )

1749 +

1750 +

1751 +async def provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert(

1752 + request: ProvisionMonitoringAlertRequest,

1753 +) -> ProvisionWazuhMonitoringAlertResponse:

1754 + """

1755 + Provisions Fortinet WIDS Wireless Weak Encryption Detected monitoring alert.

1756 + """

1757 + logger.info(

1758 + "Invoking provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert " f"with request: {request.dict()}",

1759 + )

1760 + await provision_alert_definition(

1761 + GraylogAlertProvisionModel(

1762 + title="FORTINET - WIDS WIRELESS WEAK ENCRYPTION DETECTED",

1763 + description="FORTINET - WIDS WIRELESS WEAK ENCRYPTION DETECTED",

1764 + priority=2,

1765 + config=GraylogAlertProvisionConfig(

1766 + type="aggregation-v1",

1767 + query='syslog_type:fortinet AND (logdesc:"Wireless risky_encryption detected" OR logdesc:"Wireless Weak WEP IV detected")',

1768 + query_parameters=[],

1769 + streams=[],

1770 + group_by=[],

1771 + series=[],

1772 + conditions={"expression": None},

1773 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1774 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1775 + event_limit=1000,

1776 + ),

1777 + field_spec={

1778 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1779 + data_type="string",

1780 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1781 + ),

1782 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1783 + data_type="string",

1784 + providers=[

1785 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1786 + ],

1787 + ),

1788 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1789 + data_type="string",

1790 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1791 + ),

1792 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1793 + data_type="string",

1794 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1795 + ),

1796 + },

1797 + key_spec=[],

1798 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1799 + alert=True,

1800 + ),

1801 + )

1802 + return ProvisionWazuhMonitoringAlertResponse(

1803 + success=True,

1804 + message="Fortinet WIDS wireless weak encryption detected monitoring alert provisioned successfully",

1805 + )

1806 +

1807 +

1808 +async def provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert(

1809 + request: ProvisionMonitoringAlertRequest,

1810 +) -> ProvisionWazuhMonitoringAlertResponse:

1811 + """

1812 + Provisions Fortinet Suspicious Super Admin Login Detected monitoring alert.

1813 + """

1814 + logger.info(

1815 + "Invoking provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert " f"with request: {request.dict()}",

1816 + )

1817 + await provision_alert_definition(

1818 + GraylogAlertProvisionModel(

1819 + title="FORTINET - SUSPICIOUS SUPER ADMIN LOGIN DETECTED",

1820 + description="FORTINET - SUSPICIOUS SUPER ADMIN LOGIN DETECTED",

1821 + priority=2,

1822 + config=GraylogAlertProvisionConfig(

1823 + type="aggregation-v1",

1824 + query='syslog_type:fortinet AND subtype:"system" AND logdesc:"Admin login successful" AND profile:"super_admin" AND method:"jsconsole" AND status:"success" AND srcip_reserved_ip:false',

1825 + query_parameters=[],

1826 + streams=[],

1827 + group_by=[],

1828 + series=[],

1829 + conditions={"expression": None},

1830 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),

1831 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),

1832 + event_limit=1000,

1833 + ),

1834 + field_spec={

1835 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1836 + data_type="string",

1837 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],

1838 + ),

1839 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(

1840 + data_type="string",

1841 + providers=[

1842 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),

1843 + ],

1844 + ),

1845 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(

1846 + data_type="string",

1847 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],

1848 + ),

1849 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(

1850 + data_type="string",

1851 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],

1852 + ),

1853 + },

1854 + key_spec=[],

1855 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),

1856 + alert=True,

1857 + ),

1858 + )

1859 + return ProvisionWazuhMonitoringAlertResponse(

1860 + success=True,

1861 + message="Fortinet suspicious super admin login detected monitoring alert provisioned successfully",

1862 + )

1863 +

1864 +

1865 async def provision_paloalto_monitoring_alert(

1866 request: ProvisionMonitoringAlertRequest,

1867 ) -> ProvisionWazuhMonitoringAlertResponse: