LDAP sync moving "FortiSIEM Analysts" (7.2.0)

[nisse]

With the case revamp on fortiSIEM 7.2.0, there was a need to have users in the "FortiSIEM Analysts", which seemed to work fine. Until the group was magically empty after a while.

It seems that our scheduled discovery for LDAP are moving users back from the builtin group "FortiSIEM Analysts" to the group created by discovery (see image below).

Is this fixable, or is the workaround just creating local users so that cases can be created?

[premchanderr]

Hi @nisse ,

This is by design and currently no workaround . The AD user would be removed from FortiSIEM Analysts group even if you move manually upon re-discovering.