NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ57

VerifiedIncidents, notifications, and remediation

A critical server is sending traffic that triggers a high-severity outbound intrusion prevention system (IPS) permitted IPS exploit rule. This traffic must be allowed. Which two items must you configure to prevent this server from triggering the incident?

Choose two
Explanation

A subpattern filter can exclude the server IP so its permitted IPS events no longer match the rule. A rule exception can also suppress incident generation for a specified incident attribute such as that IP address. Group-by settings determine how matching events are grouped, while aggregate thresholds and time windows change detection sensitivity rather than exempting a specific server.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!