NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ50

VerifiedRules and subpatterns

Refer to the exhibits.

Question Image

Question Image

You want the displayed rule to trigger when three failed login attempts take place within 3 minutes.

Which condition time-window and aggregate values meet this objective?

Explanation

A three-minute condition window is 180 seconds. Because the aggregate is configured as COUNT (Matched Events) > value, a value of 2 causes the rule to trigger when the count reaches 3 failed-login events.

Community Discussion

No comments yet. Be the first to start the discussion!