NSE7-SOC-AR-7-6: Fortinet NSE 7 - Security Operations 7.6 ArchitectDemo

Question

Refer to the exhibit.

Question Image

What two errors are in the incident subpattern rule configuration?

Choose two

A The aggregate operator is incorrect.
B The Group By attributes conflict with each other.
C The subpattern is missing a time window definition.
D The mandatory Event Type attribute is missing.

Explanation

A log-clearing detection requires an aggregate condition that triggers when one or more matching events are present, such as COUNT(*) >= 1; COUNT(Matched Events) < 1 instead tests for no matches. The event filter must include the Event Type that identifies the Windows security log-clearing event. Fortinet’s built-in Windows Security Log Cleared rule uses an Event Type filter and COUNT(*) >= 1; its time window is configured at the rule level.

Learn more

FortiSIEM Windows Security Log Cleared rule

NSE7-SOC-AR-7-6: Fortinet NSE 7 - Security Operations 7.6 ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ53

Community Discussion