Executable file posting rule

Hi jrpayne,

I have moved your post to the FortiSIEM community group, where you are more likely to receive a reply.

Kind regards,

Hello @jrpayne,

First thing, you should get familiar with rules and how they are designed. First start could be the documentation: https://help.fortinet.com/fsiem/7-1-7/Online-Help/HTML5_Help/Rules.htm

I would also recommend the Fortinet NSE training (FCP FortiSIEM) for this very complex product.

In general, rules look at the input data with filters, just as you do in the Analytics pane. They then use an aggregation function (in the Analytics pane the group by possibility on the upper right), usually for counting how many of these events happend in a defined timeframe.

(simplified) The rule engine then checks every 30 seconds if the conditions are met and raises an Incident, if yes. Only in that moment, the engine will check for your exceptions, which means two things:

1) In the resulting table in RAM, the things you like to filter by must be present

2) All the calculation and lookup has already happend. So the CPU and RAM had to be used for this, event if an exceptions results in no Incident being thrown.

As a conclusion, best way always is to edit the rule and not the exceptions.

In your case, you would configure the condition so that it excludes events that are related to your specified applications. You can just use the Analytics view to try to get a result that matches your needs.

If you do not want to get application logs at all, you can pre-filter the logs already before they are stored into the eventDB.

In case you need further help, feel free to ask.

Best,

Christian