// sigma convert -t kusto -p microsoft_xdr, generated 10 Nov 2026. NOT run against a live tenant.
// ===== fortimanager_fgfm_registration_peer_events.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== fortimanager_script_shell_config_push.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== net_firewall_fgfm_public_source.yml (-p microsoft_xdr)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== win_net_fgfm_port_connection.yml (-p microsoft_xdr)
DeviceNetworkEvents
| where RemotePort in~ ("541", "542")

