FAZ - FortiSoC - Handlers

[ac1]

Hi all,

How can i generate alerts only for events that have "allow" or "pass" action?

I tried to apply pre-filters excluding this type of action but they don't seem to work, we continually receive blocked traffic alerts that are not useful to us.

Thanks

ac1

[Anthony_E]

Hello ac1,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello,

I have found this document:

https://fortianalyzer4.rssing.com/chan-67445925/all_p3.html

Could you please tell me if it answering your question?

Regards,