Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

HafizJasmi
New Contributor

Exception Rule not working

Hi Guys,

I try to create exception rule by clicking incident -> Action > Edit Rule Exception.

UploadedImages_2AAbiY35QYCbXkYymilJ_temp.png
but it still trigger the incident. Any ideas?
2 REPLIES 2
RobertEvans
New Contributor III

Hi Muhammad,

The operator contains is checking for an exact string match where Info URL contains the string literal "teamviewer.com, digicert.com", it is not treating this as a list.
You could probably do this two ways.

Probably the most reliable way to exclude:
Info URL CONTAINS teamviewer.com OR
Info URL CONTAINS digitcert.com

An alternative is to try:
Info URL IN "teamviewer.com","digicert.com"  -- Where the IN is an exact match of the info url. e.g. teamviewer.com won't match test.teamviewer.com or test2.teamviewer.com
HafizJasmi

Thanks for the reply