// sigma convert -t kusto -p sentinel_asim, generated 10 Nov 2026. NOT run against a live tenant.
// ===== fortimanager_fgfm_registration_peer_events.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== fortimanager_script_shell_config_push.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== net_firewall_fgfm_public_source.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== win_net_fgfm_port_connection.yml (-p sentinel_asim)
imNetworkSession
| where NetworkDirection =~ "true" and (DstPortNumber in~ ("541", "542"))

