Muting

Muting allows you to ignore authorized and expected behaviors to identify anomalies for the specific host. When a detector is muted, any related detection will have a status of Muted. This means a notification will not be generated for the detection. A muted detection will auto-resolve after the specified time frame or can be resolved manually.

To view all muted devices, detectors, and detections, go to the Mutes and excludes.

Mute all detectors for a device

Muting a device for all detectors is most commonly used for devices like sandboxes and vulnerability scanners, which routinely trigger detections as part of their normal operation. Since these alerts are expected, muting such devices is often one of the first steps when configuring FortiNDR Cloud.

To mute a device for all detectors:

1. Click the Detections tab.
2. In the toolbar, click the gear icon at the right side of the page and select Muted Devices. The Muted Devices page opens.

   

3. Click Add New device Range.
4. In the Device IP or Range field, enter an IP address or CIDR range.
5. Click Add Device(s).

Mute a detector

Muting a detector will cause all its future detections to be muted, regardless of which device triggered the detector. This is commonly used for posture-aware detectors that identify approved or expected behavior.

To mute a detector:

1. Click the Detections tab.
2. Click the menu icon in the last column at the right-side of the page, and select Mute Detector.

   

3. In the dialog that opens, enter a comment in the Comments field, and click Mute Detector.

Mute a device

You can mute a device for a detection, detector or an account. This is commonly used for suspicious behaviors from approved devices, such as remote access from an administrator workstation. Detections that contain a muted detector are appended with Muted in the Status of column of the Detections Table.

To mute a device:

1. Click the Detections tab and open a detector in the list.
2. In the Impacted Devices tab, select the detection that contains the device and detector.
3. Click the Actions menu at the right side of the page and select one of the following options.
   • Mute Device for Detection
   • Mute Device for Detector
   • Mute Device for Account

   

4. In the dialog that opens, enter a comment in the Comments field, and click Mute Detector.

Alliteratively, you can go to Detections > Detections Table. In the Action column, click the menu and select Mute device for detector.

Viewing muted devices

Option	Description
Mutes and Excludes	Click the gear icon at the top-right of the page and select Mutes and Excludes. Scroll down to the Muted Devices
Detections	Go to Detections. Click the Settings menu at the top-right of the page. Under Actions select Muted Devices.
Detections Table	Go to Detections > Detections Table. Click the column selector and show the Device Muted column