NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 AnalystDemo

By Fortinet · Question Mode

QuestionQ21

Rules and subpatterns

An analyst has just performed a new analytics search and wants to create a rule from it.

Which method is the most efficient way to create the rule?

  • A Save the search as a template, and create a new rule from the template.
  • B Make a new rule using the Create Rule option in the Actions menu.
  • C Manually re-create the analytics search in the rule configuration.
  • D Copy and paste the raw analytics search text into a rule subpattern.
Explanation

In FortiSIEM, creating a rule from an Analytics search automatically copies key search parameters into a rule template: search filters become subpattern filters, search display conditions become group-by conditions, and the aggregate condition is initially set to COUNT(Matched Events) >= 1.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!