NSE5-FAZ-7-2: Fortinet NSE 5 - FortiAnalyzer 7.2 Analyst

A completed FortiAnalyzer playbook job is marked Failed if one or more of its tasks fail to complete successfully, even when other tasks complete successfully. Upstream_failed is a task status indicating failure to connect with an upstream device.

The FortiSIEM management extension application is a FortiAnalyzer-hosted collector that must register with and is centrally managed by a FortiSIEM Supervisor. It is not deployed as a separate dedicated virtual machine.

FortiAnalyzer Outbreak Detection Service is a licensed feature. When its license is valid, FortiAnalyzer automatically downloads Fortinet-created outbreak event handlers and reports from FortiGuard. Outbreak alerts are available from any ADOM, and notifications for new alerts appear in the interface banner rather than being delivered by email.

Threat hunting enables analysts to proactively investigate SIEM log data, filter and drill down into relevant activity, and identify potential threats before they become confirmed incidents. FortiAnalyzer provides Threat Hunting as a SOC analytics dashboard backed by its SIEM database.

FortiAnalyzer Fabric permits multiple FortiAnalyzers operating in Analyzer mode to be configured as members, and all members must use the same timezone as the supervisor. Each listed device is in Analyzer mode and uses the same Pacific Time (GMT-8:00) timezone; differing disk capacity and concurrent-report limits do not disqualify a device from membership.