NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Question

FortiSIEM rules are typically evaluated as events are received (streaming).

How can a rule be created to evaluate events over an 8-hour interval?

Explanation

Scheduled evaluation runs a FortiSIEM rule on a defined schedule, allowing it to evaluate collected events across a specified historical period such as eight hours. Streaming evaluation processes events as they arrive and is not the appropriate mode for this periodic analysis.

Learn more

Creating Rules | FortiSIEM 7.5.1

NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

AstroTutor

Notes

Readiness

QuestionQ3

Community Discussion