Which statement about thresholds is true?
Answer(s): C
FortiSIEM evaluates performance metrics against both global thresholds, which apply system-wide, and per-device thresholds, which can be customized for individual devices. This dual approach allows flexibility in monitoring while ensuring consistent baseline alerting.
Which running mode takes the most time to perform machine learning tasks?
Answer(s): B
In Local mode, FortiSIEM performs machine learning tasks using the full dataset without optimization shortcuts, making it the most time-consuming mode compared to Local Auto, Forecasting, or Regression.
Refer to the exhibit.The analyst is troubleshooting the analytics query shown in the exhibit.Why is this search not producing any results?
The issue is that the "User" attribute is incorrectly assigned a Device IP group value, which is a mismatch of attribute types. "User" expects a user name or identity, not a device IP group. This mismatch between the attribute type and the provided value causes the search to return no results.
Refer to the exhibit.If you group the events by Reporting Device, Reporting IP, and Application Category, how many results will FortiSIEM display?
Grouping by Reporting Device, Reporting IP, and Application Category yields five unique tuples:(FW01, 10.1.1.1, DB), (FW02, 10.1.1.2, WebApp), (FW01, 10.1.1.1, SSH), (FW03, 10.1.1.3, DB), and (FW04, 10.1.1.4, SSH).
Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?
The correct syntax to match an exact username in FortiSIEM analytics search is User IS jsmith. This ensures that the UEBA tag is applied only when the event is specifically tied to the user "jsmith", which is required for accurate behavioral analytics.
Post your Comments and Discuss Fortinet FCP_FSM_AN-7.2 exam prep with other Community members: