Where must you define and assign a custom python script as a remediation action?

• A.Remediation Policy
• B.Automation Policy
• C.Script Policy
• D.Rule Engine Policy

Comment: *

Name: *

Email: *

Verification: *

An analyst wants to create a rule from a newly created analytics search.
What is the quickest method?

• A.On the Analytics tab, click Actions > Create Rule.
• B.Create a new rule under Resources > Rules and fill in the search details.
• C.On the Analytics tab, click the New button next to the Filter By box.
• D.On the upper menu bar on any tab, click the pencil icon.

Comment: *

Name: *

Email: *

Verification: *

What feature defines when an incident is created by FortiSIEM?

• A.CMDB
• B.Cases
• C.Analytics
• D.Rules

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibits.



You are troubleshooting why the rule shown in the exhibit is generating incidents for successful Remote Desktop Protocol (RDP) connections with correct logins. It should only be triggering when a person fails a login three or more times to the target device when connecting with RDP.
What is causing the rule to be triggered by correct login events?

• A.The attribute types in the subpatterns do not match
• B.The RDP login is different from the login used to access the target device.
• C.The subpattern relationship RDP_Connection:User = Failed_Logon:User never matches.
• D.The Boolean between the subpatterns is incorrect.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

If you group the events by User and Count attributes, how many results will FortiSIEM display?

• A.Two
• B.Six
• C.Three
• D.Five
• E.One

Comment: *

Name: *

Email: *

Verification: *