FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

Question

Refer to the exhibit below.

Question Image

What will this analytics search show?

A Failed login events from all users in the Logon Failure user group
B Failed machine login events sourced from servers in the CMDB
C Failed login events from all servers in the Server Inventory CMDB report
D Failed login events from all servers in the CMDB

Explanation

The search combines an Event Type filter for the Logon Failure group with a Destination IP filter whose values come from the Device IP attribute in the Server Inventory report. Because the conditions are joined with AND, it returns failed login events for destinations listed as servers in that report.

Learn more

FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

AstroTutor

Notes

Readiness

QuestionQ15

Community Discussion