FortiGate Configuration File Downloaded

Last updated 6 days ago on 2026-01-28

Created 6 days ago on 2026-01-28

About

This rule detects the download of a FortiGate device configuration file. Configuration exports contain sensitive data including administrator password hashes, LDAP bind credentials, VPN pre-shared keys, routing tables, and firewall policies. Threat actors exploiting CVE-2026-24858 have been observed exporting the full device configuration immediately after gaining access to harvest credentials and map the internal network.

Tags

Use Case: Threat DetectionTactic: CollectionDomain: NetworkData Source: FortinetData Source: Fortinet FortiGateLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Configuration Repository (T1602)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-fortinet_fortigate.*
Related Integrations: fortinet_fortigate(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗any where event.dataset == "fortinet_fortigate.log" and
    event.code == "0100032095" and
    fortinet.firewall.action == "download"

Install detection rules in Elastic Security

Detect FortiGate Configuration File Downloaded in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).