NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Question

You want to create a rule with multiple subpatterns, but trigger an incident only if three distinct subpatterns match over a 24-hour period. Where must you define the time period the rule uses to evaluate all subpatterns?

Explanation

The rule-level time window is a correlation condition: it determines whether the defined pattern or patterns occur within the specified interval before an incident is triggered. Multiple subpatterns and their relationships are configured in the rule’s Define Condition step, so the shared 24-hour evaluation period belongs there.

Learn more

NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

AstroTutor

Notes

Readiness

QuestionQ38

Community Discussion