FCP-FSM-AN-7-2Preview

Refer to the exhibit.

A FortiSIEM analyst is investigating an issue by examining events related to two destination IP addresses. However, the analyst is not getting any results from the search.

Based on the selected filters shown in the exhibit, why is the search returning no results?

Refer to the exhibit.

What will FortiSIEM display if you apply the Group By and Display Fields configuration to a list of allowed firewall connections?

You need a model for predicting a target field based on other fields in a dataset and then trigger an anomaly if the value does not match the prediction.

Which machine learning algorithm will build this type of model?

When FortiSIEM is configured to apply ZTNA tags, what is the order of events when an analyst wants to automatically block a ZTNA tagged host?

In FortiSIEM, which database stores discovery information?

Refer to the exhibits.

Three events are collected over 10 minutes from two servers: Server A and Server B.

Based on the settings for the rule subpattern and a 10-minute condition window, how many incidents will the servers generate?

What must match when referencing an inner query from an outer query?

Where must you define and assign a custom python script as a remediation action?

In an automation policy, which two methods can you use to notify analysts when an incident is triggered? (Choose two.)

Refer to the exhibit.

If you group the events by Reporting IP, Event Type, and User attributes, how many results will FortiSIEM display?

What are the four incident status values on FortiSIEM?

When selecting multiple rules at once on FortiSIEM, what actions can you perform?

Refer to the exhibit.

What will this analytics search display?

Which two data areas can you use for user and entity behavior analytics (UEBA) machine learning models? (Choose two.)

Refer to the exhibits.

An analyst is troubleshooting why the rule shown in the exhibit is generating incidents for successful RDP connections.

Given the rule conditions and subpatterns, what is causing the problem?

How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

Refer to the exhibit.

If you group the events by Reporting Device, Reporting IP, and Application Category, how many results will FortiSIEM display?

Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

Which two settings must you configure to allow FortiSIEM to apply tags to devices in FortiClient EMS? (Choose two.)

Refer to the exhibit.

What happens when an analyst clears an incident generated by a rule containing the automation policy shown in the exhibit?