Skip to main content
Visitor III
July 20, 2026
Question

Repeated drop in risk score on FortiSiem.

  • July 20, 2026
  • 4 replies
  • 53 views
Repeated drop in risk score on FortiSiem.
FortiSIEM version: 7.5.1.0620Installation type: Supervisor + Workers
The drop began around July 11 (the FortiSIEM Risk Score rapidly fell to 0 over approximately three days; incidents continue to be generated normally, but the Risk Score dashboard stopped reflecting expected values), dropping to zero again starting Friday the 17th, remaining at zero on Saturday, and rising again on Monday. There were no updates to the tool.
The overall Risk Score dashboard shows zero; however, some clients have risk scores above 2 (so not all clients are affected). Incidents continue to be created normally, and correlation rules are still triggering.
Has anyone experienced this problem or can give me a hand?

4 replies

Muttahar_Rehman
Explorer
July 20, 2026

Hi,

check supervisor error and db disk status

phxctl status
df -h
 

grep -i "risk" /opt/phoenix/log/* 2>/dev/null
 

aggregation failures

database timeouts

scheduler errors

job execution failures

Thanks, R3hsec
Roberto_CAuthor
Visitor III
July 20, 2026

 

Roberto_CAuthor
Visitor III
July 20, 2026

.

Roberto_CAuthor
Visitor III
July 20, 2026

.

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!