https://community.splunk.com/t5/Splunk-Enterprise-Security/Fortigate-Active-resposne/m-p/420826#M5195 <P>Does anyone have any experience of the Fortigate active response - <A href="https://splunkbase.splunk.com/app/3444/">https://splunkbase.splunk.com/app/3444/</A></P> <P>If so do you know if there is a new policy created each time a block is initated as a result of an alert or if it is a single policy and new IP's are appended to that policy. </P> <P>If it is a new policy - how have you managed cleaning it up afterwards when the block is no longer required?</P> Thu, 05 Jul 2018 08:15:55 GMT jsimpson 2018-07-05T08:15:55Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Fortigate-Active-resposne/m-p/420826#M5195 <P>Does anyone have any experience of the Fortigate active response - <A href="https://splunkbase.splunk.com/app/3444/">https://splunkbase.splunk.com/app/3444/</A></P> <P>If so do you know if there is a new policy created each time a block is initated as a result of an alert or if it is a single policy and new IP's are appended to that policy. </P> <P>If it is a new policy - how have you managed cleaning it up afterwards when the block is no longer required?</P> Thu, 05 Jul 2018 08:15:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Fortigate-Active-resposne/m-p/420826#M5195 jsimpson 2018-07-05T08:15:55Z