Skip to main content
juanc
Explorer
October 22, 2025
Solved

Show incidents that were not blocked

Hello,

 

I am a monitoring analyst, and I have access to FAZ1000F v7.6.3.

 

When I go to “Incidents & Events,” I find a large number of incidents, but when I take the source IP of these events and go to “Log View,” I find that the event was blocked by the firewall.

 

I understand that for FAZ it is an incident even if it has been contained, but it generates noise for me. I am interested in seeing only the incidents that were not blocked. Is this possible?

 

If so, how can I do it?

 

Thank you.

 

 

filiaks1
filiaks1Answer
Explorer III
October 23, 2025

What about clonning the event handler and making your own that makes incidents for logs that are for not blocked attacks ?

 

Raising an incident | FortiAnalyzer 7.6.4 | Fortinet Document Library

Creating a custom event handler | FortiAnalyzer 7.6.4 | Fortinet Document Library

1 reply

filiaks1
filiaks1Answer
Explorer III
October 23, 2025

What about clonning the event handler and making your own that makes incidents for logs that are for not blocked attacks ?

 

Raising an incident | FortiAnalyzer 7.6.4 | Fortinet Document Library

Creating a custom event handler | FortiAnalyzer 7.6.4 | Fortinet Document Library

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT