Incident triggered but suppressed

[martinschmitt]

When doing a rule test the test result will show "Incident triggered but suppressed because fired too frequently". Anyone knows where this suppression feature is documented?

[premchanderr]

Hi @martinschmitt ,

It looks like the rule test is working but system is reaching some incident rate limit.

You can open a ticket with TAC and provide Fortisiem health report of super and all workers. 

After review TAC engineer would suggest few fine tuning for rules or provide workaround to increase limit in configuration.

[PartBhat]

https://help.fortinet.com/fsiem/7-1-0/Online-Help/HTML5_Help/troubleshooting-incident-trigger.htm

See #8