Preamble:
We're developing an alert from a Fortigate firewall trap. The specific one at this stage (though it is up for discussion) is: fgTrapHASwitch
Initially to ensure the process worked I also enabled the logic of the trap rule to look for:
OR Contains fgTrapHaStateChange
OR Contains fgTrapHaHBFail
OR Contains fgTrapHaMemberDown
Is there a way, within the alert logic or something I haven't seen to only raise the one alert and to NOT raise more for the next x minutes?