Visit the Known Issues dashboard if you are experiencing issues on RSA Link
The attached is a Correlation rule I create if the minute average of a message with policy id zero (Deny Policy) with the same Source address and Destination Address increased by 25%.
is it written correctly?
I have downloded ...I will see and let you know on this.
Which version of Fortinet do you have