FortiSIEM fine tuning

Hi labsession101,

Are you using a multi tenant version or enterprise version? In a multi tenant environment you need to consider that fine-tuning could (but does not need to) be different for each tenant.

Anyways, we are using the following processes here:

• Avoid making exceptions. E.g.: If a rule should not match on a specific device, either the device is in the "wrong" CMDB group or there are more general reason for not using the rule here, instead of excluding a single device.
  In our experience, the more exceptions you create, the more difficult it is to reproduce why something happened but we did not see an Incident
• Copy a rule, disable it and refine the copy. If you need to get back to the original one, you can also get the original idea again.
• (generally for rules) Avoid inserting single values, like an exact IP address. Try to use CMDB/resource values as often as possible to be flexible for other tenants
• We do always write down changes to rules in a separate document/wiki. Ca. once a month, we review all the refined rules, if the refinement still makes sense.

Does this help? Or are you looking for specific examples of refinements here?

Best,

Christian