Creating a detector

Create detectors to monitor suspicious behavior on the network. You can create and store up to 50 detection detectors per account. An error message appears when you reach the limit. We recommend reviewing your detectors on a regular bases to ensure they are still in use. Consider deleting detectors that are no longer in use. To increase the detector limit for an account, contact Customer Support.

Before you create a detector, consider using a detector filter to customize a detector created by Fortinet. detector filters save time creating a new detector and help manage the number of detectors in your account. For information, see Adding custom filters to a detector query.

To create a detector:

1. Click the Detections tab.
2. In the toolbar at the top-right of the page, click the shield icon. The Create A Detector page opens.

   

3. Click Select acNew Query. The Select a New Query dialog opens.

   1. Click the Saved Queries or Query History tabs to create the new detector. Optionally, you can enter key words in the Search for Query field to search for a query.

   2. Choose a query from the list and click Select. To select an adhoc query, expand Private Search.

   

4. Configure the detector settings and click Save detector.

   Impacted Device IP can appear in the fields	Click Change Fields to select the specific fields you want to use to generate a detection. By default, any internal IP address in the src.ip or dst.ip fields will be used to generate detections.
   Indicators are captured in the fields	Click Change Fields to add or remove an Indicator Field for a detector. You can choose up to five fields.
   Name	Enter a name for the detector.
   Severity	Choose High, Moderate or Low.
   Confidence	Choose High, Moderate or Low.
   Category	Click the drop down to select a category from the list.
   Primary Technique	Enter the Primary Technique ID.
   Secondary Technique	Enter the Secondary Technique ID.
   Run on Accounts	Click Manage Run List to choose which accounts the new detector should run in. In the dialog that opens, choose an account and click Save. This is applicable only if you have access to multiple accounts. For example, if your organization acquired another organization, once you deploy sensors in their network, it might be easier to ingest that data into a separate account and give your team access to it. If you were to write a detector targeting specific subnets in your account, that detector wouldn't be applicable to the acquired company's network, so you would only want to deploy it in your account.
   Data Sources	Enable/disable Zeek, Fortinet, Zuricata, or Zscaler.
   Resolution Style	Select Auto or Manual.
   Automatic Resolution Period	Select 6 hours to 1 Month.