How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

When a FortiSIEM rule triggers, it generates an incident with a unique key based on the rule name, incident source, and incident target. If the same rule triggers again with the identical key attributes, FortiSIEM does not create a new, separate incident. Instead, it performs incident aggregation by updating the existing incident record. Specifically, it increments the Incident Count value and updates the Last Seen timestamp to reflect the most recent occurrence. This mechanism prevents incident flooding and consolidates recurring events into a single, manageable entry.

A. FortiSIEM does not use a "Repeated" status for incident aggregation; it uses the Incident Count field to track the number of occurrences.

C. The "Rule Frequency" setting determines how often a rule is evaluated, not how it handles repeated triggers by generating new incidents.

D. Generating a new incident for each trigger is inefficient and would clutter the incident dashboard. FortiSIEM's aggregation logic is designed to prevent this.

---

1. FortiSIEM 7.0.0 Concepts Guide

Chapter: Incidents

Section: Incident Aggregation.

"When a rule triggers

FortiSIEM checks if an incident with the same rule name

incident source

and incident target already exists. If it does

then FortiSIEM increments the incident count and updates the last seen time of the existing incident. If it does not

then FortiSIEM creates a new incident."

2. FortiSIEM 7.0.0 Administration Guide

Chapter: Using the Analytics View

Section: Viewing Incidents.

This section describes the incident table columns

including Incident Count ("Number of times the incident has occurred") and Last Seen ("Time the incident last occurred")

which are the two fields updated during aggregation.