Show incidents that were not blocked

[juanc]

Hello,

I am a monitoring analyst, and I have access to FAZ1000F v7.6.3.

When I go to “Incidents & Events,” I find a large number of incidents, but when I take the source IP of these events and go to “Log View,” I find that the event was blocked by the firewall.

I understand that for FAZ it is an incident even if it has been contained, but it generates noise for me. I am interested in seeing only the incidents that were not blocked. Is this possible?

If so, how can I do it?

Thank you.

[filiaks1 · Accepted solution]

What about clonning the event handler and making your own that makes incidents for logs that are for not blocked attacks ?

Raising an incident | FortiAnalyzer 7.6.4 | Fortinet Document Library

Creating a custom event handler | FortiAnalyzer 7.6.4 | Fortinet Document Library