FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

The rule requires forwarded traffic to RDP port 3389, followed within 300 seconds by at least three Logon Failure events. The User and Source IP must be identical across both subpatterns. A brute-force attempt against an RDP server and five failed application logons during an RDP-over-SSL-VPN session can meet those event, count, sequence, and correlation requirements. Two failures are below the configured threshold, while connecting to an incorrect IP address does not itself create the required logon-failure sequence.