# Source: https://docs.datadoghq.com/security/default_rules/def-000-023.md

---
title: Fortinet Fortimanager successful brute force login
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Fortinet Fortimanager successful brute
  force login
---

# Fortinet Fortimanager successful brute force login

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1110-brute-force](https://attack.mitre.org/techniques/T1110) 
## Goal{% #goal %}

Detects successful brute force attacks against Fortinet FortiManager administrative accounts.

## Strategy{% #strategy %}

This rule monitors Fortinet FortiManager authentication logs for patterns indicating brute force attacks followed by successful compromise. The detection triggers when more than 4 failed admin login attempts are followed by at least one successful login for the same user account. This pattern suggests an attacker has successfully compromised an administrative account after multiple failed authentication attempts.

## Triage & Response{% #triage--response %}

- Verify if the successful login for `{{@usr.name}}` was legitimate by checking with the account owner or reviewing scheduled administrative activities.
- Examine the source IP addresses of both failed and successful login attempts to determine if they originated from expected locations.
- Review the timing between failed attempts and successful login to assess if the pattern indicates automated brute force activity.
- Check for any administrative actions performed by `{{@usr.name}}` immediately after the successful login to identify potential malicious activity.
- Determine if the compromised account has elevated privileges and assess the potential impact of unauthorized access.