FortiSIEM: Rule sync error

26 replies
9263 views

Hello,

I cloned the existing "Windows Security Log Cleared" rule in the rules and created it in a new name, only I made the within value 120, not 600, and made the rule in the default disable. However, this time, when the rule was triggered, it created an incident with the name in the default and gave a sync error error in the rule. What could be the reason?

Fortisiem

Richie_CAnswer

Staff

yes indeed. As per the documentation:

https://help.fortinet.com/fsiem/7-1-1/Online-Help/HTML5_Help/Notification_Settings.htm

"Notifications will be sent only if an incident occurs during the time range you set here."

Richie_C

Staff

Hi

My suggestion would be to export the rules (both default and cloned) from the GUI in XML format. You can then compare the rules in a text editor.

My guess is that there is some confusion between the rule name and the Incident title. You can either amend the XML and import the rule or edit the incident title under Define Action > Action.

I hope it helps!

adem_netsysAuthor

Explorer III

Hi @Richie_C

first of all thank you for your interest, my other question is about the notification part. Although I added the rules here, I think the notification is not working stable because I want it to send an e-mail every time it is triggered, but it does not do this continuously, I have not encountered such a problem before.

Ekran görüntüsü 2024-01-05 153744.png Ekran görüntüsü 2024-01-04 200959.png

Richie_C

Staff

I am not aware of anything in the rule that would cause this behaviour.

It is possible to check the notification history of an incident. you should see that the email is sent successfully. Or maybe an error will be displayed. more information can be found here:

https://help.fortinet.com/fsiem/7-1-1/Online-Help/HTML5_Help/FortiSIEM_Operations_Incidents_and_Cases.htm?Highlight=action%20history

Richie_C

Staff

adem_netsysAuthor

Explorer III

Hi @Richie_C

Obviously, this is the current working rule, I deleted the one I cloned. The rule creates an incident but does not send notifications, and the notifications sent come randomly, not within a certain period of time. For example, two incidents occur, they are available in the notification policy, but one of them comes.

Richie_C

Staff

If you are saying that a new incident is triggered, but it does not create an email as configured, then it doesn't sound like normal behaviour. This would probably require a TAC case.

However, if it is the repeat of a previously triggered rule, then by default it would only trigger again after 24 hours.

As previously mentioned, you can check the notification history for the incident.

https://help.fortinet.com/fsiem/7-1-1/Online-Help/HTML5_Help/FortiSIEM_Operations_Incidents_and_Cases.htm

In the latest version 7.1 we can see the history in a nice new view: