Skip to main content
ebudi
New Member
October 12, 2023
Question

Fortisiem Cases

  • October 12, 2023
  • 3 replies
  • 2395 views

We just completed deploying our in house FortiSIEM v7

The System User keeps creating cases automatically, is there a way to turn it off so that only SOC analysts can create the cases?

3 replies

Hatibi
Staff & Editor
Staff & Editor
October 13, 2023

Hi Eugene,

 

are you refering to tickets created automatically by Incident Notification Policies?

If you go to  ADMIN > Settings > General > Notification Policy and edit the Policies you have the option " Create Case when an incident is created " which creates them automatically.

 

Regards

ebudi
ebudiAuthor
New Member
October 16, 2023

H sx11,

That's what I'm referring to. I have not configured any notifications policy that involves creation of cases for incidents. It keeps generating new cases under user "System" as shown below. This is affecting our MTTR.

ebudi_0-1697435156456.png

 

 

ebudi_1-1697435156434.png

 

 

ebudi
ebudiAuthor
New Member
October 14, 2023

H sx11,

That's what I'm referring to. I have not configured any notifications policy that involves creation of cases for incidents. It keeps generating new cases under user "System" as shown below. This is affecting our MTTR.

1.png

 

2.png

Hatibi
Staff & Editor
Staff & Editor
October 16, 2023

 Hi Eugene,

 

if you edit those 2 notification policies that are referenced in your image do they have the below option enabled?

Create_Case_Not_policy.png

 

Regards

ebudi
ebudiAuthor
New Member
December 7, 2023

Quick update, it turned out to be a bug. An upgrade to version 7.1 fixed it