Fortinet white logo
Fortinet white logo

Administration Guide

Default Cloud Anomaly Policies

Default Cloud Anomaly Policies

This topic lists the default cloud anomaly policies.

For more information about these alerts, see Cloud activity anomaly alerts in the FortiCNAPP Alerts Reference.

AWS Behavior Anomaly Policies

The following table specifies the default AWS behavior anomaly policies.

Policy ID Alert Generated by Policy
LW_AWS_ACCNT_86 New access made
LW_AWS_API_97 Service Called API
LW_AWS_API_98 API Failed With Error
LW_AWS_ERR_92 New Error Code
LW_AWS_LOGIN_94 Login From New Source Location
LW_AWS_MODELSERVICE_155 Unexpected Change in AWS API Error Volume
LW_AWS_MODELSERVICE_156 Unexpected Change in AWS GPU Instance Launch Volume
LW_AWS_REGION_90 New Region
LW_AWS_REGION_91 New AWS API invoked
LW_AWS_REGION_95 User Accessing Region
LW_AWS_REGION_96 New AWS service accessed in region
LW_AWS_SERVICE_89 New Service
LW_AWS_USR_87 AWS User Logged in from New Source
LW_AWS_USR_88 User Calltype MFA

Azure Behavior Anomaly Policies

The following table specifies the default Azure behavior anomaly policies.

Policy ID Alert Generated by Policy
LW_AZURE_API_142 New Azure API Call Accessed Resource
LW_AZURE_ERROR_140 New Azure API Failed
LW_AZURE_EVENT_141 New Azure Operation On Resource
LW_AZURE_SERVICE_138 New Azure Service
LW_AZURE_SUBSCRIPTION_137 New Azure Subscription

Google Cloud Behavior Anomaly Policies

The following table specifies the default Google Cloud behavior anomaly policies.

Policy ID Alert Generated by Policy
LW_GCP_ACCNT_107 New GCP organization
LW_GCP_ERROR_118 GCP API failed with error
LW_GCP_LOGIN_108 New GCP source
LW_GCP_LOGIN_114 GCP user logged in from source
LW_GCP_REGION_111 New GCP region
LW_GCP_REGION_115 GCP user accessing region
LW_GCP_REGION_116 New GCP service accessed in region
LW_GCP_SERVICE_110 New GCP service
LW_GCP_SERVICE_112 New GCP API call
LW_GCP_SERVICE_117 New GCP API invoked for GCP service
LW_GCP_USR_109 New GCP user

Default Cloud Anomaly Policies

Default Cloud Anomaly Policies

This topic lists the default cloud anomaly policies.

For more information about these alerts, see Cloud activity anomaly alerts in the FortiCNAPP Alerts Reference.

AWS Behavior Anomaly Policies

The following table specifies the default AWS behavior anomaly policies.

Policy ID Alert Generated by Policy
LW_AWS_ACCNT_86 New access made
LW_AWS_API_97 Service Called API
LW_AWS_API_98 API Failed With Error
LW_AWS_ERR_92 New Error Code
LW_AWS_LOGIN_94 Login From New Source Location
LW_AWS_MODELSERVICE_155 Unexpected Change in AWS API Error Volume
LW_AWS_MODELSERVICE_156 Unexpected Change in AWS GPU Instance Launch Volume
LW_AWS_REGION_90 New Region
LW_AWS_REGION_91 New AWS API invoked
LW_AWS_REGION_95 User Accessing Region
LW_AWS_REGION_96 New AWS service accessed in region
LW_AWS_SERVICE_89 New Service
LW_AWS_USR_87 AWS User Logged in from New Source
LW_AWS_USR_88 User Calltype MFA

Azure Behavior Anomaly Policies

The following table specifies the default Azure behavior anomaly policies.

Policy ID Alert Generated by Policy
LW_AZURE_API_142 New Azure API Call Accessed Resource
LW_AZURE_ERROR_140 New Azure API Failed
LW_AZURE_EVENT_141 New Azure Operation On Resource
LW_AZURE_SERVICE_138 New Azure Service
LW_AZURE_SUBSCRIPTION_137 New Azure Subscription

Google Cloud Behavior Anomaly Policies

The following table specifies the default Google Cloud behavior anomaly policies.

Policy ID Alert Generated by Policy
LW_GCP_ACCNT_107 New GCP organization
LW_GCP_ERROR_118 GCP API failed with error
LW_GCP_LOGIN_108 New GCP source
LW_GCP_LOGIN_114 GCP user logged in from source
LW_GCP_REGION_111 New GCP region
LW_GCP_REGION_115 GCP user accessing region
LW_GCP_REGION_116 New GCP service accessed in region
LW_GCP_SERVICE_110 New GCP service
LW_GCP_SERVICE_112 New GCP API call
LW_GCP_SERVICE_117 New GCP API invoked for GCP service
LW_GCP_USR_109 New GCP user