DRAG DROPUsing the default data ingestion wizard in FortiSOAR, place the incident handling workflow from FortiSIEM to FortiSOAR in the correct sequence. Select each workflow component in the left column,hold and drag it to a blank position in the column on the right. Place the four correct workflow components in order, placing the first step in the first position at the top of the column.
Answer(s): A
1. FortiSIEM incident 2. FortiSOAR alert 3. FortiSOAR indicator 4. FortiSOAR incidentIn the standard integration between FortiSIEM 7.3 and FortiSOAR 7.6, the data ingestion wizard follows a specific object mapping hierarchy to ensure that high-fidelity security events are managed correctly.Step 1: FortiSIEM incident: The workflow begins in FortiSIEM. When a correlation rule triggers, it generates an Incident (not just a raw log). The FortiSOAR connector polls the FortiSIEM APIspecifically for these incident records.Step 2: FortiSOAR alert: By default, ingested FortiSIEM incidents are mapped to the Alerts module in FortiSOAR. This serves as a "triage" layer where automated playbooks can perform initial analysis before a human determines if it warrants a full-scale investigation.Step 3: FortiSOAR indicator: As the alert is processed (either during ingestion or immediately after), the playbook extracts technical artifacts (IPs, hashes, URLs) and creates Indicator records. This allows for automated threat intelligence lookups and cross-referencing against other alerts.Step 4: FortiSOAR incident: If the alert is validated (either through automated playbook scoring or manual analyst review), it is promoted to a FortiSOAR Incident. This represents a confirmed security issue that requires formal tracking, remediation, and reporting.
Review the incident report:Packet captures show a host maintaining periodic TLS sessions that imitate normal HTTPS traffic but run on TCP 8443 to a single external host. An analyst flags the traffic as potential command-and- control. During the same period, the host issues frequent DNS queries with oversized TXT payloads to an attacker-controlled domain, transferring staged files.Which two MITRE ATT&CK techniques best describe this activity? (Choose two answers)
Answer(s): A,C
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In accordance with the MITRE ATT&CK mapping utilized by FortiSIEM 7.3 and FortiSOAR 7.6, the described behaviors correspond to the following techniques:Non-Standard Port (T1571): This technique involves adversaries communicating using a protocol and port pairing that are typically not associated. The incident report identifies HTTPS (TLS) traffic running on TCP 8443 rather than the standard port 443. FortiSIEM specifically includes built-in correlation rules, such as "Suspicious Typical Malware Back Connect Ports," designed to detect these protocol-port mismatches.Exfiltration Over Alternative Protocol (T1048): This technique describes adversaries stealing data by exfiltrating it over a different protocol than the primary command and control (C2) channel. In this scenario, while the C2 channel is established via HTTPS on port 8443, the adversary is transferring staged files using DNS queries with oversized TXT payloads. DNS is a common "alternative protocol" used to bypass standard data transfer monitoring and egress filtering.Analysis of Incorrect Options:Exploitation of Remote Services (B): This technique falls under Initial Access or Lateral Movement tactics, focusing on gaining entry into a system via vulnerabilities in network services like SMB or RDP. It does not apply to the maintenance of an established C2 channel or the exfiltration of data.Hide Artifacts (D): This is a Defense Evasion technique where an adversary attempts to conceal their presence by removing traces such as log files or registry keys. While the attacker is "imitating normal traffic," the specific acts of using a non-standard port and DNS exfiltration are primary behavioral signatures defined by their own more specific techniques.
Refer to the exhibits.How is the investigation and remediation output generated on FortiSIEM? (Choose one answer)
Answer(s): C
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In FortiSIEM 7.3, a key innovation is the integration of FortiAI, which provides generative AI capabilities to assist SOC analysts during the triage and response process.Generative AI Summary: When an incident occurs, FortiAI can automatically analyze the underlying logs, correlation logic, and MITRE ATT&CK techniques (such as "Exfiltration Over Alternative Protocol" shown in the exhibit) to generate a human-readable summary.Structured Output: The output displayed in the exhibit--specifically the categorized Investigation Actions (identifying affected systems, analyzing traffic) and Remediation Actions (immediate containment, patching, user training)--is the typical result of a FortiAI summary request.Analyst Efficiency: This feature is designed to reduce the "mean time to respond" (MTTR) by providing analysts with immediate, actionable steps without requiring them to manually piece together the recommended response plan from static documentation or disparate log views.Why other options are incorrect:Exporting an incident (A): Exporting an incident typically results in a raw data file (CSV/JSON/PDF) containing the log data and metadata, rather than an AI-generated strategic plan for investigation and remediation.Running an incident report (B): Standard incident reports provide statistical and historical data about incidents over time. They do not dynamically generate specific, numbered investigation steps tailored to the unique context of a single live incident.Context tab (D): The Context tab in FortiSIEM is primarily used to view the CMDB information of the involved assets (e.g., host details, owner, location) and related historical events. While it provides the data needed for an investigation, it does not provide the list of actions to take.
What are three capabilities of the built-in FortiSOAR Jinja editor? (Choose three answers)
Answer(s): A,B,D
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:The built-in Jinja editor in FortiSOAR 7.6 is a powerful utility designed to help playbook developers write and test complex data manipulation logic without having to execute the entire playbook. Its primary capabilities include:Renders output (A): The editor provides a "Preview" or "Evaluation" pane. By combining a Jinja expression with a sample JSON input (manually entered or loaded), the editor dynamically calculates and displays the resulting output. This allows for immediate verification of data transformation logic.Checks validity (B): The editor includes built-in linting and syntax validation. It alerts the developer to errors such as unclosed brackets, incorrect filter usage, or invalid syntax, ensuring that only valid Jinja code is saved into the playbook step.Loads environment JSON (D): One of the most significant features for troubleshooting is the ability to load the environment JSON from a recent execution. This populates the editor's variable context (vars) with the actual data from a specific playbook run, allowing the developer to test expressions against real-world data that recently passed through the system.Why other options are incorrect:Creates new records in bulk (C): While Jinja expressions are used to format the data that goes into a record, the actual creation of records is handled by the "Create Record" step or specific Connectors, not by the Jinja editor utility itself.Defines conditions to trigger a playbook step (E): Jinja is the language used to write conditions within a "Decision" step or "Step Utilities," but the Jinja Editor is a tool for evaluating and testing those expressions. The definition of the condition logic and the triggering behavior is a function of the Playbook Engine and Step configuration, not the editor's standalone capabilities.
Refer to the exhibit.You configured a playbook named False Positive Close, and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem? (Choose two answers)
Answer(s): C,D
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In FortiSOAR 7.6, manual playbooks appear in the Execute menu of a record only if they meet specific configuration criteria defined in the Manual Trigger step:Module Scope (C): When creating a playbook with a manual trigger, the administrator must explicitly select which modules (e.g., Alerts, Incidents, Indicators) can execute the playbook. If the Alerts module is not selected in the "Applicable Modules" section of the trigger configuration, the playbook will remain hidden from the Execute menu when an analyst is viewing the Alerts module.Trigger Execution Requirements (D): Manual triggers can be configured to execute on no records, a single record, or multiple records. If a playbook is configured with the "Requires record input to run" setting but is specifically restricted to a different input type (or if there is a mismatch in the selection logic), it will not appear in the menu unless the correct number of records are selected. Furthermore, if a playbook is designed to run only when no record is selected (global utility), it will not show up in the context-sensitive menu of a specific record.Why other options are incorrect:Publishing (A): FortiSOAR playbooks do not require a separate "publishing" step via an Application Editor to become visible. Once they are saved and active (toggled on), they are immediately available for use based on their trigger settings.Concurrent Execution (B): FortiSOAR allows multiple instances of the same playbook to run simultaneously. An active execution of a playbook does not hide it from the menu for other analysts or subsequent runs.
Post your Comments and Discuss Fortinet NSE7_SOC_AR-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE7_SOC_AR-7.6 content, but please register or login to continue.