A new event handler is available for admins to monitor FortiGate IPS logs for the IPS signatures that are on hold.
To use the IPS signatures on-hold event handler:
- Go to FortiSoC > Handlers > Event Handler List.
The Default-IPS_Signature_On_Hold event handler is displayed and is disabled by default.
Double-click the event handler to view its filter definition.
- Right-click on the event handler in the event handlers list, and click Enable. Events will be generated for IPS signature that are on hold.