Rule Issue

[adem_netsys]

Hello guys,

We have one default rule and when I run it, I can see the audit logs run, but it does not fall as an incident. What could be the reason for this?

 

[anignan]

Hi @adem_netsys ,

It should generate an incident based on your Action.. Can you check if you have the correct time range filter in the incident dashboard?

Abdel

[adem_netsys]

Hi,

Yes, i have correct time range but i couldnt understand why. I have not found this error in a different version.

[anignan]

Hi @adem_netsys ,

Do you have at least some incidents generated by default rules? What is FSM version?

[adem_netsys]

In 7.0.2 environment we get this problem. In the latest version the same rule successfully generates the incident.