NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Question

An analyst has just performed a new analytics search and wants to create a rule from it.

Which method is the most efficient way to create the rule?

Explanation

In FortiSIEM, creating a rule from an Analytics search automatically copies key search parameters into a rule template: search filters become subpattern filters, search display conditions become group-by conditions, and the aggregate condition is initially set to COUNT(Matched Events) >= 1.

Learn more

FortiSIEM 7.5.1: Working with Search Results

NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

AstroTutor

Notes

Readiness

QuestionQ21

Community Discussion