Approving Newly Discovered Devices
When devices are discovered by FortiSIEM, monitoring of them begins automatically, and incidents for those devices will trigger automatically based on the rules associated with that device. However, you can configure the Discovery Settings so incidents will be triggered only for devices you approve. If you select Approved Devices Only for Allow Incident Firing On, then you will need to approve devices before incidents will be triggered for those devices, but they will still be monitored and added to the CMDB.
- Log in to your Supervisor node.
- Go to Admin > Discovery Results.
- Select a discovery result.
- Click View Changes.
- Expand the folder Discovery Delta.
- Expand the folder New Devices.
- Select the devices you want to approve, and click Approve Selected.
You can approve all the new devices by selecting the New Devices folder, and then click Approve All.
Related Links
Discovery Settings
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!