Settings reference

Governance, Settings is for administrators only. Every change made here is written to the audit log. The tabs are Connections, Sign-in methods, Users & access, Approval chains, Policies & schedules, Notifications, License and System.

Server-level settings (secrets, the database, deploy mode) are environment variables instead. See Server configuration.

Connections

FortiManagers, standalone FortiGates and offline snapshots; the ADOMs and firewalls table with each management domain's workspace mode and approvers; configuration backups of standalone FortiGates.

See Connections, Connect a FortiManager, Connect a standalone FortiGate and Offline snapshots.

General (public address, FireSight accounts), LDAP / Active Directory, OpenID Connect and SAML, each with group-to-role mapping. See Sign-in methods.

Users & access

The People table, Add user, Edit, Unlock, and What each role can do. See Users and roles.

Approval chains

Standard chains, the emergency chain, ADOM assignments, Conditions and Deleted chains. See Approval chains and Conditions.

Policies & schedules

Settings in five panels. Change any number, then click Save N changes (at the top of the first panel, or below the last). Whole numbers must be within the range shown in their hint.

Security

Setting	Default	Range	Meaning and when to change it
Inactive rule threshold (days)	90	7 to 3650	Policies not hit for this many days are reported as Inactive. Lower it for a stricter clean-up; raise it for rarely used services.
Session length (minutes)	480	15 to 1440	How long a sign-in stays valid. Applies to new sign-ins.
Failed sign-ins before lockout	5	3 to 20	Consecutive failures that lock an account.
Lockout duration (minutes)	15	1 to 1440	How long a locked account stays locked. An administrator can Unlock it sooner.
Minimum password length	12	12 to 128	Applies to FireSight accounts, when a password is set or changed.

The defaults of Inactive rule threshold, Session length and the lockout settings come from environment variables until saved here. See Server configuration.

Approvals

Setting	Default	Meaning and when to change it
Allow self-approval	off	Let requesters approve stages of their own rules. Not recommended.
Same approver for several stages	off	Let one person approve more than one stage of the same chain. Turn on only in a small team where one person holds several approver roles.
Different people for each chain	off	When a request goes to several chains at once, require a different person in each chain. Off: someone who sits in two chains can approve both. Turn on for stricter separation.
Requesters and approvers may deploy	off	Let an implementer deploy a rule they requested or approved. Not recommended.
Allow emergency changes	off	Requesters can mark a change as an emergency. It is approved by the emergency chain only, can be deployed straight away, and is then reviewed by the normal chains. See Emergency changes.
Emergency review deadline (hours)	72 (1 to 720)	How long after deployment the review of an emergency change is due. Overdue reviews are highlighted.
Require change ticket	off	Rule requests must reference a change ticket (Change ticket becomes required).

DNS

Setting	Default	Meaning
Look up DNS names for host addresses	on	Show the DNS name of every single-host source and destination, and accept host names instead of addresses on rule requests.
Convert entries to DNS names if available	off	Name the address objects FireSight creates after the host's DNS name instead of its IP address.
DNS-named objects match on	IP address (recommended)	Or FQDN (follows DNS).
DNS servers	empty	Comma-separated IP addresses. Empty uses the server's own resolver.

See DNS names.

Schedules

Setting	Default	Range	Meaning
Sync connections every (minutes)	60	0 to 1440	Pull management domains, devices, policies, routes and hit counts from every live connection. 0 turns scheduled syncs off.
Audit every package after a scheduled sync	on		Re-run the rule audit so findings stay current.
Check for expired rules every (minutes)	15	0 to 1440	Rules past their Remove after date are backed out automatically. 0 turns this off.

Scheduled jobs run in the FireSight container when FIRESIGHT_SCHEDULER is true (the default). The scheduler wakes every 30 seconds and runs whatever is due.

Monitoring

Setting	Default	Range	Meaning
Check firewall health every (minutes)	5	0 to 1440	Reachability, CPU, memory, sessions and interface load. 0 turns monitoring off.
Down after missed checks	2	1 to 20	A firewall is reported down after this many checks in a row can't reach it.
Congestion threshold (% of link speed)	80	10 to 100	An interface carrying more than this, in either direction, is flagged as congested.
Congested after checks over the threshold	3	1 to 20	Ignore short bursts: alert only after this many checks in a row over the threshold.
Interface errors and drops per minute	60	1 to 100000	More than this on an interface is flagged as a possible fault or overload.
CPU warning (%)	90	10 to 100	Warn when a firewall's CPU is above this.
Memory warning (%)	90	10 to 100	Warn when a firewall's memory use is above this.

See Device health.

Notifications

Email (SMTP), Microsoft Teams, Slack and generic webhooks for device health alerts, which events to send, and Send a test. See Notifications.

License

This installation (status, firewalls in use, license details, system serial, installation ID), Activate this system (Download activation request), Install a license file, and Online renewal. See Licensing.

System

Read-only facts about the server:

Field	Shows
Version	The FireSight version.
Interface build	The build reference and time of the web interface.
Environment	`prod` or `dev`.
Deployments	Live or Simulated.
Sign-in methods	The methods turned on.
Database	The database in use.

Banners warn when Deployments are simulated and when the server is Running with development defaults. These values are set by environment variables on the server, so they can't be changed from the browser.