NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ20

VerifiedIncidents, notifications, and remediation

Refer to the exhibit.

Question Image

If the Capture Variable step receives the source IP address from an incident and the Block Source IP on FGT step blocks that source IP address on the configured firewall, what occurs when this playbook executes?

Explanation

A variable defined by a Set Variable/Capture Variable step can be used by all remaining connected playbook steps. Each of the three downstream FortiGate blocking actions therefore receives the same source IP captured from the incident, while applying it to its respective configured firewall.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!