Skip to main content
adem_netsys
Explorer III
October 17, 2024
Question

All active rules in the installation

  • October 17, 2024
  • 3 replies
  • 910 views

As you know, when we first install FortiSIEM, there are many rules that come active by default, which triggers rules and creates incidents as log sources are added. Our goal is to eliminate false positives here. So, is there any chance to disable the active rules without adding log sources during the initial setup phase?

    3 replies

    adem_netsys
    Explorer III
    October 19, 2024

    Hi,

    Has anyone experienced it before?

    premchanderr
    Staff & Editor
    Staff & Editor
    October 21, 2024

    HI @adem_netsys ,

     

    You can activate and deactivate rule groups. 


    Documentation:

    https://help.fortinet.com/fsiem/7-2-3/Online-Help/HTML5_Help/Activating_and_deactivating_rules.html#Activati3 

     

    adem_netsys
    Explorer III
    October 21, 2024

    Hi @premchanderr 

     

    I guess I couldn't see it due to a version-related situation, then I got what I wanted

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!