The attached is a Correlation rule I create if the minute average of a message with policy id zero (Deny Policy) with the same Source address and Destination Address increased by 25%.
is it written correctly?
I have downloded ...I will see and let you know on this.
Which version of Fortinet do you have
Retrieving data ...