List Unwanted Or Malicious Applications Detected By Fortinet
Description
This KQL query searches for unwanted or malicious applications detected by Fortinet.
Qurery
Microsoft Sentinel
Kusto
CommonSecurityLog
| where DeviceVendor == "Fortinet"
| where DeviceAction == "accept"
| extend additional_fields = split(AdditionalExtensions, ";")
| where additional_fields[22] == "ad.apprisk=high" or additional_fields[22] == "ad.apprisk=critical"
| summarize sessions=count() by category = tostring(additional_fields[21]), application = (tostring(additional_fields[20]))
| sort by sessions