NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 AnalystDemo

By Fortinet · Question Mode

QuestionQ64

Rules and subpatterns

Refer to the exhibit.

Question Image

You are investigating a problem involving two destination IP addresses, but the search is not returning any results.

Based on the filters shown in the exhibit, why does this search return no results?

  • A You are using the wrong Boolean operator in the Next column.
  • B The two items are not grouped in parentheses ().
  • C You are using an invalid IP address in the Value column.
  • D You are using an incorrect entry in the Operator column.
Explanation

Event-attribute filters are Boolean expressions, and the Next field selects the AND/OR operator that joins consecutive conditions. Joining Destination IP = 10.10.10.1 and Destination IP = 192.168.1.1 with AND requires one event’s Destination IP to equal both different addresses. The conditions must be joined with OR to return events for either destination address.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!