SIEM Rules for detecting exploitation of vulnerabilities in FortiCloud SSO

AI-suggested

European organizations should immediately deploy the Kaspersky SIEM correlation rules package '[OOTB] FortiCloud SSO abuse package – ENG' to detect suspicious activities related to FortiCloud SSO exploitation attempts. Ensure comprehensive and normalized logging from all Fortinet devices (FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb) with SSO enabled, including populating the 'Extra' field for enriched event context. Conduct retrospective analysis starting from December 2025 to identify any past exploitation attempts. Tune detection rules to reduce false positives by whitelisting known legitimate administrative IP addresses and accounts. Enforce strict FortiCloud account security policies, including multi-factor authentication (MFA), strong password requirements, and monitoring for anomalous FortiCloud account activities. Limit the use of FortiCloud SSO where possible or apply additional network segmentation and access controls to restrict administrative access. Regularly update Fortinet devices with the latest security patches once available and monitor vendor advisories for patch releases addressing these vulnerabilities. Finally, integrate Fortinet device logs with broader enterprise threat detection platforms to correlate suspicious activities across the environment.