QuestionQ29Verified/Incidents, notifications, and remediationCopy linkReport a problemAsk AstroTutorSave questionHow does FortiSIEM update incident details when the same rule is triggered repeatedly?AFortiSIEM updates the Incident Count value and Last Seen timestamp.BFortiSIEM generates a new incident each time the rule triggers and updates all the First Seen and Last Seen timestamps.CFortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.DFortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.Show AnswerAnswerExplanationFor repeated occurrences of an incident with the same group-by parameters, FortiSIEM increments the incident count and advances the Last Seen time. The First Seen time remains the time of the original occurrence.Learn moreFortiSIEM 7.5.0 Rule LogsShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion