NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Question

Several newly deployed internal servers are generating incidents and need to be excluded from several FortiSIEM rules.

How should you tune rules to exclude several undiscovered devices from the rules?

Explanation

A CMDB device group provides a reusable collection of devices that rules can filter. Adding the servers to a device group already excluded by the relevant rules prevents those rules from generating incidents for the group while leaving the rules active for other devices.

Learn more

Working with Device Groups | FortiSIEM 7.0.0

NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

AstroTutor

Notes

Readiness

QuestionQ6

Community Discussion