NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 AnalystDemo

Question

Refer to the exhibit.

Question Image

Why does this search return no results?

A You cannot reference both the User and Event Type attributes in the same analytics search.
B You did not use the configuration management database (CMDB) group search properly.
C You must set the Time Range to Real-time to identify login failures.
D There is a nested query attribute type mismatch.
E You must set the Operator to = for both queries.

Explanation

A nested search comparison must use compatible data types. A User attribute holds user-name/text values, whereas Device IP holds IP-address values; comparing them with IN cannot produce matching events. IBM QRadar reference-data guidance likewise distinguishes user-name and IP-address values as separate property types for comparisons.

Learn more

Types of reference data collections

NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 AnalystDemo

AstroTutor

Notes

Readiness

QuestionQ13

Community Discussion