FCP_FSM_AN-7.2 試験問題を無料オンラインアクセス

What feature defines when an incident is created by FortiSIEM?

• A.Cases
• B.Rules
• C.CMDB
• D.Analytics

Refer to the exhibit.

As shown in the exhibit, why are some of the fields highlighted in red?

• A.The attribute COUNT(Matched Events) is an invalid expression.
• B.The Event Receive Time attribute is not available for logs.
• C.No RAW Event Log attribute information is available.
• D.Unique values cannot be grouped.

How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

• A.FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.
• B.FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.
• C.FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.
• D.FortiSIEM updates the Incident Count value and Last Seen timestamp.

Which two attributes can you not select together in the Group By and Display Fields? (Choose two.)

• A.Raw Event Log
• B.Source IP
• C.Destination IP
• D.Reporting IP
• E.Event Reporting Time

Refer to the exhibit. What will FortiSIEM display if you apply the Group By and Display Fields configuration to a list of allowed firewall connections?

• A.A list of connections between unique source and destination IP addresses
• B.A running count of connections, regardless of source or destination
• C.A list of connections ordered by the number of unique connections started by each source IP address
• D.A list of connections ordered by destination IP address hit count