Staff

Technical Tip: 'Rule Name' attribute is blank when added as display field in 'All Incidents' system report

Description

This article provides steps to add rule names for respective incidents in the 'All Incidents' report.

Scope

FortiSIEM v7.x and above.

Solution

Note that the 'Rule Name' attribute does not exist for internal incident events returned by analytics query 'System Event Category = 1'.

Follow these steps to see rule names in the 'All Incidents' report:

Navigate to Resources -> Reports and run the report 'All Incidents'.
In analytics, add 'Event Type' attribute to 'Group By and Display Fields' and select 'Apply & Run'.
Rule names for the respective incident would be listed in the 'Event Name' column.
Select the 'Actions' drop-down, followed by 'Save as Report' to create a custom report.

Sign up