NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ42

VerifiedRules and subpatterns

A rule that identifies network connections to an SSH server is firing constantly because of background internet traffic and needs to be tuned. Which method should be used to tune this rule and resolve the issue?

Explanation

Increasing the subpattern's COUNT (Matched Events) threshold makes the rule require multiple matching SSH connection events before it triggers. This reduces incidents generated by isolated, routine background connections. FortiSIEM uses aggregate conditions, including COUNT(Matched Events), to set the event threshold that triggers a rule.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!