I have a problem with displaying the event handler in fortisoc, in the sense that once set the event works correctly but the events counter, in the right side of the screen, seem to reset automatically and I can't get an actual history of how many times the handler has worked.
Is there any tweak that can help me not reset the event count?
Could you please share the FAZ version? Also, can you confirm if there is any pattern in the count reset? For example, after a change or after reaching a particular time interval? Is it going back to zero or the number is reduced/changed?
Also, can you check if the logs triggering the events are getting archived and that leads to reset of the counter as there is no active logs for this event?
- Have you found a solution? Then give your helper a "Kudos" and mark the solution.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.