Incidents

Incidents cut triage and investigation time by grouping together policy detections that have the same root cause. With this automated, condensed view of related detections, you get the context you need to assess and respond to threats without the hassle.

Let's say the Sensitive file uploaded to personal file share website policy has been configured to raise incidents that group detections by a common, unauthorized domain name—for example, drive.google.com. If 200 users across multiple departments attempt to upload sensitive files to Google Drive, this would result in a single incident comprised of 200 detections.

How an incident is formed depends on the associated policy's clustering rule. Clustering rules can be configured to group detections together as an incident based on a common property (such as a domain name, filename, and so on) or a common policy. For details, refer to the FortiDLP Policies Reference Guide.

Once an incident is raised, subsequent related detections are added to it until it is investigated and resolved by an operator. After an incident is resolved, a subsequent detection that is clustered in the same manner would raise a new incident. If needed, resolved incidents can be reopened to enable further review of historical information. FortiDLP retains incidents indefinitely and retains incident detections for 372 days.

Actions associated with incidents/incident detections are subject to the standard retention period. Therefore, artifacts resulting from actions—for example, screenshots—will not be viewable past your retention period.

Max active limit and fallback incident

A policy can generate incidents that group detections by a maximum of 100 active, distinct cluster data key values.

For example, if you configure the Sensitive file uploaded policy template, which clusters detections by domain name, the corresponding key would be hostname and the values would be the specific domain names by which detections are grouped as incidents.

When a detection occurs that has the 101st cluster data key value, it will be added to a "fallback" incident, as well as a detection with the 102nd value and so on.

For example, with the Sensitive file uploaded policy template, the first 100 website domains will create individual incidents. After the bounding limit is reached, all detections—independent of their associated domain—will be added to a single fallback incident until at least one of the previous 100 incidents is resolved.

You can view and manage incidents from the Incidents module and the Incident details page.