FortiSIEM Activating and Deactivating Rules

Activating and Deactivating Rules

When you create a new rule, you must activate it before it will start to monitor events. You may also want to deactivate a rule, for example to test it, instead of deleting it from the system.

1. Log in to your Supervisor node.
2. Go to Analytics > Rules.
3. Browse or search to find the rule that you want to activate or deactivate.
4. Select Active for the rule you want to activate, or clear the Active option if you want to deactivate a rule.