Technical Tip: How to Select Devices by Organization when Configuring Event Forwarding Rules

Description

This article explains how to select specific devices based on the organization when configuring an Event Forwarding rule, particularly when the options for specific devices are not visible.

Scope

FortiSIEM v7.x+.

Solution

This guide supplements the Event Forwarding guide available in the Event Handling Settings section, specifically step 4 of the guide.

In a Service Provider deployment, however, devices from other organizations may not be visible, even if the user is logged in as the Full Admin.

To resolve this, change the organization view:

• Navigate to the top right of the FortiSIEM GUI.
• Select the arrow pointing to the right.

• Select Change Organization View -> Switch to Organization.
• Select the relevant organization that requires the rule.

Once switched to the correct organization, it will now be possible to select specific devices associated with that organization.

Note:

Ensure all steps are followed to correctly configure the Event Forwarding rule across organizations.