Successful Logon from Outside My Country

Hello @ishak,

Best practice would be to add the countries to "My Home" in the "Country Groups" (Resources), so no rule change is required.

If this is not possible (e.g. your employees travel a lot worldwide or you use a multi-tenant deployment with multiple requirements), you would need to edit (duplicate) the rule and make sure it ignores countries only for specific event types. If you cannot differentiate in the rule specification, disabling it completely would make more sense.

If you like to create something new from scratch, either have a look at the ML features or have a deeper look into the Fortinet Training "FCSS Security Operations", where different aspects of baseline rules are explained.

Best,

Christian