NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

FortiSIEM’s Edit Multiple Rules feature lets an authorized user change the severity for the selected rules and set or clear their active status, thereby activating or deactivating them in bulk.

The Windows UEBA agent collects dedicated, high-precision telemetry for user file and network activity, with complete user and file context. Log-based sources such as Sysmon and Linux logs provide only a subset of the user activities available through the FortiSIEM UEBA agent.

Scheduled evaluation runs a FortiSIEM rule on a defined schedule, allowing it to evaluate collected events across a specified historical period such as eight hours. Streaming evaluation processes events as they arrive and is not the appropriate mode for this periodic analysis.

FortiSIEM’s MITRE ATT&CK functionality includes a Rule Coverage View, which maps coverage provided by security rules, and an Incident Coverage View, which maps detected security incidents to MITRE ATT&CK tactics and techniques.

PH_DEV_MON_SYS_UPTIME is the event type identifier for system-uptime monitoring. sysUpTime, phLogDetail, and PHL_INFO are individual event data or severity values, rather than the event type.