Hello all,
we analyze logs from out fortigate 100D and we notice that on every line we have this two param
unauthuser="aaaa@bbbb.it" unauthusersource="pop3"
aaaa@bbbb.it doesn't exist as user on firewall.
How could be possible that it record on every log line? Where firewall get it?
Thanks
have you found some informations about it?
I opened a ticket cause im noticing this kind of unauthuser a lot.
I have no clue cause this traffic is from and to verious IPs and it is not an attack. I called my customer and it was legit. It seems to be logged no matter what
User | Count |
---|---|
983 | |
818 | |
446 | |
440 | |
130 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.