NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ37

VerifiedRules and subpatterns

Refer to the exhibits.

Question Image

Question Image

Question Image

You are troubleshooting why the rule shown in the exhibit generates incidents for successful Remote Desktop Protocol (RDP) connections with valid logins. It should trigger only when a person fails to log in three or more times to the target device while connecting through RDP.

What is causing the rule to trigger on correct login events?

Explanation

The subpatterns are connected with OR, so either a port-3389 RDP connection or three failed logon events is sufficient to trigger the rule. Because the RDP_Connection subpattern requires only one matching RDP traffic event, successful RDP connections independently satisfy the rule. FortiSIEM defines an OR relationship between subpatterns as requiring either subpattern to occur.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!