Configure FortiManager email alerts for repeated failed login attempts

The behavior you are seeing is expected: FortiManager’s own administrator login events are local FortiManager system events, not “device logs” in the FortiAnalyzer Event Handler workflow. Even when the FortiAnalyzer feature is enabled on FortiManager, the Event Handler “Device Log Type” list is for logs received from managed/logging devices, not for FortiManager’s own local admin login logs. That is why FortiManager is not available as a device log type.

No matching internal KB article was found for this exact case.

Recommended approach

Option 1 — Use FortiManager local alert email for failed admin logins

This is the correct method if you want FortiManager itself to email you when administrator login failures occur.

1. Configure the SMTP/mail server

GUI path may vary slightly by FortiManager version:

System Settings > Advanced > Mail Server

Configure:

• SMTP server
• Port
• Authentication, if required
• Sender address

CLI example:

config system mail
    set server "smtp.example.com"
    set port 587
    set authenticate enable
    set username "fmg-alerts@example.com"
    set password <password>
    set security starttls
end

If your SMTP server does not require authentication or TLS, adjust accordingly.

2. Configure alert email recipients

config system alertemail setting
    set status enable
    set mailto1 "soc@example.com"
    set mailto2 "network@example.com"
end

3. Enable alerting for failed administrator logins

Depending on FortiManager version, the exact filter names can differ. Check available options with ?.

config system alertemail filter
    set admin-login-failed enable
end

If the above option is not present, check the available filter options:

config system alertemail filter
    ?

Look for an option similar to:

admin-login-failed
login-failed
admin-login
system-event

Then enable the relevant failed-login/system-event filter.

4. Test

Attempt a failed login to FortiManager, then check:

execute log display

or from the GUI:

System Settings > Event Log

Confirm the failed login event appears, then verify whether the alert email is sent.

---

Important limitation: “after many failed login attempts”

FortiManager local alert email is generally event/filter based, not a full correlation engine. In many FortiManager versions, it can alert on each failed admin login, but it may not support a condition like:

Send one email only after 5 failed FortiManager admin logins within 10 minutes.

That type of threshold/correlation is normally handled by FortiAnalyzer Event Handlers, SIEM, or automation logic — but FortiManager’s own local logs are not exposed as a selectable “FortiManager device log type” in the embedded FortiAnalyzer Event Handler.

---

Option 2 — If you require threshold-based alerting

If your requirement is specifically:

Alert only after multiple FortiManager admin login failures within a time window

then use one of these designs:

Design A — Send FortiManager logs to an external FortiAnalyzer

Configure FortiManager to forward its local logs to a separate FortiAnalyzer or syslog/SIEM platform, then build the threshold/correlation rule there.

Example syslog forwarding:

config system locallog syslogd setting
    set status enable
    set server "192.0.2.50"
    set port 514
end

Then create the correlation rule on the external FortiAnalyzer/SIEM for events matching FortiManager failed admin logins.

Design B — Use SIEM/syslog correlation

Forward FortiManager event logs to your SIEM and create a rule such as:

If source = FortiManager
AND message contains "login failed"
AND count >= 5
AND timeframe = 10 minutes
THEN send email / create incident

This is usually the cleanest way to implement “many failed attempts” logic.

---

Why Event Handler does not show FortiManager

In the embedded FortiAnalyzer feature, Event Handlers are intended for logs from supported device types such as FortiGate and other Fortinet products sending logs into FortiAnalyzer. FortiManager’s own admin login events are local system events, so they are not listed as a FortiManager device log type in that handler creation screen.

Fortinet FortiAnalyzer Event Handler documentation:
https://docs.fortinet.com/document/fortianalyzer

FortiManager administration documentation:
https://docs.fortinet.com/document/fortimanager

---

Summary

Use this for basic failed-login email alerting:

config system mail
    set server "smtp.example.com"
    set port 587
    set authenticate enable
    set username "fmg-alerts@example.com"
    set password <password>
    set security starttls
end

config system alertemail setting
    set status enable
    set mailto1 "soc@example.com"
end

config system alertemail filter
    set admin-login-failed enable
end

If you need threshold-based alerting, forward FortiManager local logs to an external FortiAnalyzer or SIEM and build the “many failed logins within X minutes” rule there.