How to Suppress Repeat Incidents Per User in FortiSIEM

[gauravpawar]

I’m trying to build a custom rule in FortiSIEM with the following logic:

• If a specific user (e.g., abc) deletes 3 accounts within 10 minutes, an incident should be triggered.

• However, if the same user deletes another 3 accounts within the next 2 hours, the rule should not trigger again (a kind of cooldown period for that user).

• If a different user (e.g., xyz) deletes 3 accounts within 10 minutes, then the rule should trigger independently for that user.

Has anyone implemented this type of per-user cooldown or suppression in FortiSIEM?

@Secusaurus @Anthony_E could you please help here