FortiGate FGFM TCP 541 from external IP followed by FortiGateCloud admin config
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Microsoft Sentinel (KQL)
