As you know, when we first install FortiSIEM, there are many rules that come active by default, which triggers rules and creates incidents as log sources are added. Our goal is to eliminate false positives here. So, is there any chance to disable the active rules without adding log sources during the initial setup phase?
Hi,
Has anyone experienced it before?
HI @adem_netsys ,
You can activate and deactivate rule groups.
Documentation:
I guess I couldn't see it due to a version-related situation, then I got what I wanted
Welcome to your new Fortinet Community!
You'll find your previous forum posts under "Forums"
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.