Skip to main content
adem_netsys
Explorer III
July 25, 2023
Question

Create Rule

  • July 25, 2023
  • 3 replies
  • 1191 views

Hello guys,

 

I want to create a rule in siem. I want it to generate an alarm when a log is not received from a device, when I clone the existing rule, it does not succeed.

3 replies

Jean-Philippe_P
Staff & Editor
Staff & Editor
July 28, 2023

Hello adem_netsys, 

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

Thanks, 

Jean-Philippe - Fortinet Community Team
Jean-Philippe_P
Staff & Editor
Staff & Editor
July 31, 2023

Hello,

 

We are still looking for an answer to your question.

 

We will come back to you ASAP.

 

 

Thanks,

Jean-Philippe - Fortinet Community Team
srajeswaran
Staff
Staff
July 31, 2023

Can you check this post?

go to CMDB / Edit a Device / Properties Tab / Search for Events. You will see "Event Receive Time Gap Low Threshold minutes" and "Event Receive Time Gap High Threshold minutes", change these as needed.

To change it globally Admin / Device Support / Custom Properties, then search as above and edit. Also shows you the default values.


https://www.reddit.com/r/fortinet/comments/dorpfw/trying_to_modify_a_fortisiem_rule_for_delay_of/

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!