FortiSIEM Approving Newly Discovered Devices

Approving Newly Discovered Devices

When devices are discovered by FortiSIEM, monitoring of them begins automatically, and incidents for those devices will trigger automatically based on the rules associated with that device. However, you can configure the Discovery Settings so incidents will be triggered only for devices you approve. If you select Approved Devices Only for Allow Incident Firing On, then you will need to approve devices before incidents will be triggered for those devices, but they will still be monitored and added to the CMDB.

  1. Log in to your Supervisor node.
  2. Go to Admin > Discovery Results.
  3. Select a discovery result.
  4. Click View Changes.
  5. Expand the folder Discovery Delta.
  6. Expand the folder New Devices.
  7. Select the devices you want to approve, and click Approve Selected.

You can approve all the new devices by selecting the New Devices folder, and then click Approve All.

Related Links

Discovery Settings

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos