How to receive emails only for high-priority alerts with compromised hosts detected by FortiAnalyser

[MasaruO]

Hello. Please help me. Currently, I have set up FortiAnalyzer to send an email to the administrator when a compromised host is detected. However, since I receive notifications for everything detected, I end up missing critical ones. I want to receive emails only for high-priority alerts. Is there a way to do this? If it cannot be done with the standard settings, I would like to use an API or other method to achieve this.

[jasonhong]

Hi,

You can actually use the predefined event handler (Default-Compromised Host-Detection-IOC-By-Threat) in FAZ which will only be triggered based on the rule which includes Event Severity = Critical.

https://docs.fortinet.com/document/fortianalyzer/7.2.5/administration-guide/778986