NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 AnalystDemo

By Fortinet · Question Mode

QuestionQ37

Rules and subpatterns

Refer to the exhibits.

Question Image

Question Image

Question Image

You are troubleshooting why the rule shown in the exhibit generates incidents for successful Remote Desktop Protocol (RDP) connections with valid logins. It should trigger only when a person fails to log in three or more times to the target device while connecting through RDP.

What is causing the rule to trigger on correct login events?

  • A The attribute types in the subpatterns do not match
  • B The RDP login is different from the login used to access the target device.
  • C The subpattern relationship RDP_Connection:User = Failed_Logon:User never matches.
  • D The Boolean between the subpatterns is incorrect.
Explanation

The subpatterns are connected with OR, so either a port-3389 RDP connection or three failed logon events is sufficient to trigger the rule. Because the RDP_Connection subpattern requires only one matching RDP traffic event, successful RDP connections independently satisfy the rule. FortiSIEM defines an OR relationship between subpatterns as requiring either subpattern to occur.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!