Technical Tip: How to set the action to Alert Only for a specific Signature ID
Description
This article describes how to set the action to Alert Only for a specific Signature ID.
Scope
FortiWeb and FortiWeb VM.
Solution
There is a requirement to set a specific Signature ID for Known Attack to Alert Only.
This article will provide steps to set the action accordingly.
In this article example, the Signature ID used is 090230001.
Step 1: On the GUI, go to Web Protection -> Known Attacks -> Signature and select the respective Signature Policy.
Step 2: Select Signature Details from the menu at the top of the same page.
Note: It is not possible to modify or edit the pre-defined Signature policies. All the configuration options will be grayed out. Refer to the document link at the end of this article for more information.
Step 3: On the next page, select Search, change the dropdown to Signature ID, enter the signature ID, and select Search.
Step 4: The corresponding Signature ID details page will be displayed in the right panel. Enabled the Alert Only option.
Note: Once enabled, the Alert Only action will be applied accordingly immediately.
Related documents: