Defining security event exceptions
Exceptions enable you to limit the enforcement of a rule, meaning to create an allowlist for a specific flow of security events that was used to establish a connection request or perform a specific operation.
FortiEDR exception management is highly flexible and provides various options that enable you to define pinpointed, granular exceptions. You can access the Exception Manager by clicking the Exception Manager button at the top of the Events pane or by selecting SECURITY SETTINGS > Exception Manager. Additional options for managing exceptions are provided in the SECURITY SETTINGS tab, as described in Exception Manager.
An exception that applies to a security event can result in the creation of several exception pairs. An exception pair specifies the rule that was violated and the process on which the violation occurred, including or excluding its entire location path. For more details, see Playbook policies
After an exception is defined for a security event, new identical events will no longer be triggered and different indication icons are added to existing events, depending on the exception's coverage of the raw data items in the events:
-
Security events fully covered by the exception have the
icon to indicate that an exception has already been defined (although the exception was created after the event occurred) and there is no need to create another exception for them. The indication icon does not refresh afterward when new raw data items uncovered by the exception come in.
-
If the exception does not fully cover all the existing occurrences or raw data items of an event, the
icon is displayed.
The following sections describe how to create a new exception and how to edit an existing one: