Approving Newly Discovered Devices

When devices are discovered by FortiSIEM, monitoring of them begins automatically, and incidents for those devices will trigger automatically based on the rules associated with that device. However, you can configure the Discovery Settings so incidents will be triggered only for devices you approve. If you select Approved Devices Only for Allow Incident Firing On, then you will need to approve devices before incidents will be triggered for those devices, but they will still be monitored and added to the CMDB.

1. Log in to your Supervisor node.
2. Go to Admin > Discovery Results.
3. Select a discovery result.
4. Click View Changes.
5. Expand the folder Discovery Delta.
6. Expand the folder New Devices.
7. Select the devices you want to approve, and click Approve Selected.

You can approve all the new devices by selecting the New Devices folder, and then click Approve All.

Related Links

Discovery Settings