soc/wazuh-docker/single-node/config/wazuh_cluster/rules/soc-a2-forti...

<!--
  SOC Proposal Rules — Appendix A2: FortiGate IPS/IDS & Firewall
  Production profile rule IDs : 110311-110320

  Severity mapping:
    High   → level 12
    Medium → level 8
    Low    → level 5

  Parent SID reference (built-in Wazuh FortiGate rules):
    81603 — Fortigate messages grouped (universal FortiGate base)
    81606 — Fortigate: Login failed  (action=login status=failed)
    81608 — Fortigate: Configuration changed (Configuration is changed in the admin session)
    81612 — Fortigate: Firewall configuration changes (action=Edit, type=event)
    81618 — Fortigate: Traffic to be aware of (type=traffic)
    81622 — Fortigate: VPN user connected (action=tunnel-up)
    81628 — Fortigate attack detected
    81629 — Fortigate attack dropped

  Fix history:
    2026-03-19: Changed all if_group=fortigate → if_sid=81603/81618/81628/81629
                if_group=fortigate does not chain rules correctly in Wazuh 4.x;
                correct approach is if_sid pointing to a built-in parent rule.
    2026-03-20: Changed 110311/110320 from if_sid=81618 → if_sid=81603 with explicit
                type=traffic match. Wazuh 4.x does not evaluate grandchild if_sid chains
                (81603 → 81618 → 110311 fails); sibling pattern (81603 → 110311) works.
-->
<group name="soc_mvp,appendix_a,a2,fortigate,">

  <!-- A2-01: RDP traffic allowed through firewall
       Parent: 81603 (FortiGate base — NOT 81618 to avoid 3-level chain depth limit)
       Fix 2026-03-22: replaced multiple <match> (ORed) with single <regex> (AND).
       Multiple <match> elements in Wazuh fire if ANY one matches — old rule
       matched every traffic log via type=traffic or action=accept (~5M hits/day).
       dstport/action are static Wazuh fields — cannot use <field>; use PCRE2
       lookaheads in a single <regex> to require BOTH conditions in the raw log. -->
  <rule id="110311" level="12">
    <if_sid>81603</if_sid>
    <regex type="pcre2">(?=.*\bdstport=3389\b)(?=.*\baction="?accept"?)</regex>
    <description>A2-01 [PROD] FortiGate: RDP (3389) traffic allowed</description>
    <group>soc_prod,a2,rdp,</group>
    <mitre><id>T1021.001</id></mitre>
  </rule>

  <!-- A2-02: Admin password changed
       Parent: 81603 (generic base — admin events vary by FW model/version)
       FortiGate logs action="password-change" under type=event subtype=system -->
  <rule id="110312" level="12">
    <if_sid>81603</if_sid>
    <match>action="password-change"|action=password-change</match>
    <description>A2-02 [PROD] FortiGate: admin account password changed</description>
    <group>soc_prod,a2,admin_change,</group>
    <mitre><id>T1098</id></mitre>
  </rule>

  <!-- A2-03: New admin account created
       Parent: 81603 (generic base) -->
  <rule id="110313" level="12">
    <if_sid>81603</if_sid>
    <match>action="create-admin"|action=create-admin</match>
    <description>A2-03 [PROD] FortiGate: new admin account created</description>
    <group>soc_prod,a2,admin_change,</group>
    <mitre><id>T1136</id></mitre>
  </rule>

  <!-- A2-04: Alerting/notification disabled via config change
       Parent: 81608 (Configuration changed) or 81612 (Firewall config changes) -->
  <rule id="110314" level="12">
    <if_sid>81608, 81612</if_sid>
    <match>config_value=disable|"disable"</match>
    <description>A2-04 [PROD] FortiGate: alerting/notification disabled via config change</description>
    <group>soc_prod,a2,defense_evasion,</group>
    <mitre><id>T1562</id></mitre>
  </rule>

  <!-- A2-05: Firewall configuration file downloaded
       Parent: 81603 (generic base) -->
  <rule id="110315" level="5">
    <if_sid>81603</if_sid>
    <match>action="download-config"|action=download-config</match>
    <description>A2-05 [PROD] FortiGate: firewall configuration file downloaded</description>
    <group>soc_prod,a2,config,</group>
    <mitre><id>T1005</id></mitre>
  </rule>

  <!-- A2-06: Multiple critical/high IPS signatures triggered
       Parent: 81628 (attack detected) or 81629 (attack dropped)
       Note: requires FortiGate IPS UTM logs to be forwarded -->
  <rule id="110316" level="8">
    <if_sid>81628, 81629</if_sid>
    <match>severity="critical"|severity="high"|severity=critical|severity=high</match>
    <description>A2-06 [PROD] FortiGate IPS: critical/high attack signature triggered</description>
    <group>soc_prod,a2,ips,</group>
    <mitre><id>T1595</id></mitre>
  </rule>

  <!-- A2-07: TCP port scan from external IP
       Parent: 81628 or 81629 (IPS/anomaly attack events)
       Note: requires FortiGate anomaly detection to be enabled -->
  <rule id="110317" level="5">
    <if_sid>81628, 81629</if_sid>
    <match>attack="TCP.Port.Scan"|TCP.Port.Scan</match>
    <description>A2-07 [PROD] FortiGate: TCP port scan from external IP</description>
    <group>soc_prod,a2,recon,</group>
    <mitre><id>T1046</id></mitre>
  </rule>

  <!-- A2-08: IOC-based IP detection via IPS
       Parent: 81628 or 81629 -->
  <rule id="110318" level="8">
    <if_sid>81628, 81629</if_sid>
    <match>ioc_type=ip|ioc_type="ip"</match>
    <description>A2-08 [PROD] FortiGate IPS: IOC-based IP indicator detected</description>
    <group>soc_prod,a2,ioc,</group>
    <mitre><id>T1071.001</id></mitre>
  </rule>

  <!-- A2-09: Internal port scan from private source IP
       Parent: 81628 or 81629 -->
  <rule id="110319" level="8">
    <if_sid>81628, 81629</if_sid>
    <match>attack="Internal.Port.Scan"|Internal.Port.Scan</match>
    <description>A2-09 [PROD] FortiGate: internal port scan from private source IP</description>
    <group>soc_prod,a2,recon,</group>
    <mitre><id>T1046</id></mitre>
  </rule>

  <!-- A2-10: Traffic to known C2/malicious IP
       Parent: 81603 (FortiGate base — sibling pattern, same fix as 110311)
       Fix 2026-03-22: single <regex> with PCRE2 lookaheads ANDs both conditions.
       threat_label is not extracted by Wazuh's built-in FortiGate decoder so
       raw log matching via regex is required. -->
  <rule id="110320" level="8">
    <if_sid>81603</if_sid>
    <regex type="pcre2">(?=.*\btype="?traffic"?)(?=.*threat_label="?known-c2"?)</regex>
    <description>A2-10 [PROD] FortiGate: traffic to known C2/malicious IP allowed</description>
    <group>soc_prod,a2,ioc,c2,</group>
    <mitre><id>T1071.001</id></mitre>
  </rule>

</group>