FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

Question

Refer to the exhibit.

Question Image

An analyst is troubleshooting the rule displayed in the exhibit. It is not producing any incidents, although the filter parameters are generating events on the Analytics tab.

What is wrong with the rule conditions?

A The Event Type refers to a CMDB lookup and should be an Event lookup.
B The Destination Host Name value is not fully qualified.
C The Group By attributes restricts which events are counted.
D The Aggregate attribute is too restrictive.

Explanation

Aggregate thresholds are evaluated separately for each Group By combination. Grouping by Destination IP and User splits matching events into distinct groups, which can prevent any one group from reaching COUNT(Source IP) >= 2 even though the filters return events.

FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

AstroTutor

Notes

Readiness

QuestionQ14

Community Discussion