NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ64

VerifiedRules and subpatterns

Refer to the exhibit.

Question Image

You are investigating a problem involving two destination IP addresses, but the search is not returning any results.

Based on the filters shown in the exhibit, why does this search return no results?

Explanation

Event-attribute filters are Boolean expressions, and the Next field selects the AND/OR operator that joins consecutive conditions. Joining Destination IP = 10.10.10.1 and Destination IP = 192.168.1.1 with AND requires one event’s Destination IP to equal both different addresses. The conditions must be joined with OR to return events for either destination address.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!