FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

A regression model uses average memory utilization as a feature and average CPU utilization as its target. Sustained memory-utilization values become part of the model’s learned input pattern and raise its learned memory-utilization baseline; high memory utilization itself is not the target condition for an incident. FortiSIEM documents regression as predicting a target field from other feature fields.

Three minutes is 180 seconds. Because the aggregate condition uses a strict greater-than operator (COUNT(Matched Events) > value), a value of 2 causes the rule to trigger at a matched-event count of 3.

Grouping by multiple attributes produces one result for each distinct combination of their values. Five distinct Reporting Device, Reporting IP, and Application Category combinations are present because the two DB events reported by FW01 at 10.1.1.1 belong to the same group. FortiSIEM documentation describes Group By attributes as the attributes used to group events before aggregation.

The grouped rule requires a minimum of two events and an average CPU utilization strictly greater than each server's CPU-utilization critical threshold within the 10-minute window. Server A's CPU values average approximately 91.7, exceeding its threshold of 90, so it generates one incident. Server B does not exceed its threshold of 70 on average and generates no incident.

FortiSIEM Analysts is a user group in the CMDB. Fortinet defines it as the group containing the subset of FortiSIEM users who can be assigned to work on cases; analyst teams are created beneath this CMDB group.