// sigma convert -t kusto --without-pipeline, generated 10 Nov 2026. NOT run against a live tenant.
// ===== fortimanager_fgfm_registration_peer_events.yml (--without-pipeline)
log_id in~ ("0002011005", "0002011007")

// ===== fortimanager_script_shell_config_push.yml (--without-pipeline)
log_id in~ ("0005014002", "0012021007", "0012021015", "0012021023", "0001010049", "0001010113")

// ===== net_firewall_fgfm_public_source.yml (--without-pipeline)
(dst_port in~ ("541", "542")) and (not((ipv4_is_in_range(src_ip, "10.0.0.0/8") or ipv4_is_in_range(src_ip, "172.16.0.0/12") or ipv4_is_in_range(src_ip, "192.168.0.0/16") or ipv4_is_in_range(src_ip, "127.0.0.0/8") or ipv4_is_in_range(src_ip, "169.254.0.0/16"))))

// ===== win_net_fgfm_port_connection.yml (--without-pipeline)
Initiated =~ "true" and (DestinationPort in~ ("541", "542"))

