Alerting on firewall configuration changes is useful because these events often matter for both operations and security. A rule like this helps teams notice unexpected changes early and creates a clean audit trail for administrative actions on FortiGate devices.

1. Start from a Template

Open the Alerts section and choose Create New from Template. Even if there is no dedicated FortiGate configuration change template, a similar template can still be reused.

2. Reuse a Similar Rule

In the example, the switch configuration change template is used as the starting point. This is efficient because the overall rule logic is already close to what is needed.

Logmanager alert template selection screen with a similar configuration change template chosen as a base
Fig. 1: Logmanager alert template selection screen with a similar configuration change template chosen as a base.

3. Adjust the Filter

Change the filter so it matches the FortiGate configuration change logs in your environment. If the relevant tag is something like FortiGate config change, select that tag and apply it.

Edited alert filter in Logmanager showing the FortiGate configuration change tag
Fig. 2: Edited alert filter in Logmanager showing the FortiGate configuration change tag.

4. Rename and Save

Update the alert name and description so it clearly states the rule’s purpose. After saving, Logmanager will notify you whenever matching FortiGate configuration activity appears.

Final FortiGate configuration change alert saved in Logmanager
Fig. 3: Final alert definition. Capture the saved or nearly finished alert so the end result is obvious to the reader.