FortiSIEM Discussions
martinschmitt
New Contributor

Incident triggered but suppressed

When doing a rule test the test result will show "Incident triggered but suppressed because fired too frequently". Anyone knows where this suppression feature is documented?

2 REPLIES 2
premchanderr
Staff
Staff

Hi @martinschmitt ,

 

It looks like the rule test is working but system is reaching some incident rate limit.

 

You can open a ticket with TAC and provide Fortisiem health report of super and all workers. 

After review TAC engineer would suggest few fine tuning for rules or provide workaround to increase limit in configuration.

Regards,
Prem Chander R
Announcements

Welcome to your new Fortinet Community!

You'll find your previous forum posts under "Forums"