Which two processes run analytical queries and must always be running to perform searches?
(Choose two.)

• A.phAnomalyMaster
• B.phQueryWorker
• C.phRuleWorker
• D.phQueryMaster
• E.phRuleMaster

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits. Which information will this analytics search display?

• A.Failed machine login events with a source IP address of servers in the Device IP report
• B.All servers in the Logon Failure user group
• C.Failed login events from all servers in the Server Inventory configuration management database (CMDB) report
• D.Failed login events from all servers defined in the CMDB

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

How was this incident cleared?

• A.The analyst manually cleared the incident from the incident table.
• B.FortiSIEM cleared the incident automatically after 24 hours.
• C.The incident was cleared automatically by the rule.
• D.The endpoint was rebooted and sent an all-clear signal to FortiSIEM.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

An analyst is trying to identify an issue using an expression based on the Expression Builder settings shown in the exhibit; however, the error message shown in the exhibit indicates that the expression is invalid.
What is the correct syntax to create an expression that generates a total count of matched events?

• A.COUNT(Matched Events)
• B.(COUNT) Matched Events
• C.Matched Events (COUNT)
• D.Matched Events COUNT()

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

Which section contains the subpattern configuration that determines how many matching events are needed to trigger the rule?

• A.Aggregate
• B.Group By
• C.Actions
• D.Filters

Comment: *

Name: *

Email: *

Verification: *