NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Question

An analyst needs to run a remediation playbook when a user fails a VPN sign-in five times from an external machine. Where should they associate the remediation playbook with the triggering rule?

Explanation

Microsoft Sentinel automation rules invoke playbooks as configured actions. The remediation playbook is therefore attached in the associated automation rule’s Action configuration, where the Run playbook action is selected for the triggering condition.

Learn more

Automate threat response in Microsoft Sentinel with automation rules

NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

AstroTutor

Notes

Readiness

QuestionQ43

Community Discussion