FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

Question

Refer to the exhibit.

Question Image

An analyst is troubleshooting the analytics query displayed in the exhibit. Why does this search produce no results?

A The Time Range is set incorrectly.
B The inner and outer nested query attribute types do not match.
C You cannot reference User and Event Type attributes in the same search.
D The Boolean operator is wrong between the attributes.

Explanation

The IN operator requires a compatible event attribute and CMDB object. User is an identity/string event attribute, but Device IP: Server Inventory is an IP-based CMDB object; therefore, the inner CMDB lookup type does not match the outer event attribute type. FortiSIEM documentation specifically notes that a user attribute cannot be matched against a network-device CMDB object, while compatible matches such as a source IP against a network-device object are allowed.

Learn more

Creating a New Search | FortiSIEM 7.2.2

FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

AstroTutor

Notes

Readiness

QuestionQ7

Community Discussion