Fortisiem Cases

[ebudi]

We just completed deploying our in house FortiSIEM v7

The System User keeps creating cases automatically, is there a way to turn it off so that only SOC analysts can create the cases?

[Sx11]

Hi Eugene,

are you refering to tickets created automatically by Incident Notification Policies?

If you go to  ADMIN > Settings > General > Notification Policy and edit the Policies you have the option " Create Case when an incident is created " which creates them automatically.

Regards

[ebudi]

H sx11,

That's what I'm referring to. I have not configured any notifications policy that involves creation of cases for incidents. It keeps generating new cases under user "System" as shown below. This is affecting our MTTR.

[ebudi]

H sx11,

That's what I'm referring to. I have not configured any notifications policy that involves creation of cases for incidents. It keeps generating new cases under user "System" as shown below. This is affecting our MTTR.

[Sx11]

 Hi Eugene,

if you edit those 2 notification policies that are referenced in your image do they have the below option enabled?

Regards

[ebudi]

Quick update, it turned out to be a bug. An upgrade to version 7.1 fixed it