I’m trying to build a custom rule in FortiSIEM with the following logic:If a specific user (e.g., abc) deletes 3 accounts within 10 minutes, an incident should be triggered.However, if the same user deletes another 3 accounts within the next 2 hours, the rule should not trigger again (a kind of cooldown period for that user).If a different user (e.g., xyz) deletes 3 accounts within 10 minutes, then the rule should trigger independently for that user.Has anyone implemented this type of per-user cooldown or suppression in FortiSIEM? @Secusaurus @Anthony_E could you please help here

Explorer III

Question

How to Suppress Repeat Incidents Per User in FortiSIEM

I’m trying to build a custom rule in FortiSIEM with the following logic:

If a specific user (e.g., abc) deletes 3 accounts within 10 minutes, an incident should be triggered.
However, if the same user deletes another 3 accounts within the next 2 hours, the rule should not trigger again (a kind of cooldown period for that user).
If a different user (e.g., xyz) deletes 3 accounts within 10 minutes, then the rule should trigger independently for that user.

Has anyone implemented this type of per-user cooldown or suppression in FortiSIEM?

@Secusaurus @Anthony_E could you please help here