What are the four incident status values on FortiSIEM?

• A.Active, cleared, cleared manually, false positive
• B.Active, auto cleared, cleared manually, system cleared
• C.Active, closed, cleared, resolved
• D.Active, auto closed, cleared manually, resolved

Comment: *

Name: *

Email: *

Verification: *

What feature defines when an incident is created by FortiSIEM?

• A.Analytics
• B.Cases
• C.Rules
• D.CMDB

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit.

An analyst is troubleshooting the rule shown in the exhibit. It is not generating any incidents, but the filter parameters are generating events on the Analytics tab.
What is wrong with the rule conditions?

• A.The Event Type refers to a CMDB lookup and should be an Event lookup.
• B.The Destination Host Name value is not fully qualified.
• C.The Group By attributes restricts which events are counted.
• D.The Aggregate attribute is too restrictive.

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit. If you group the events by Reporting IP, Event Type, and User attributes, how many results will FortiSIEM display?

• A.Three
• B.Five
• C.Two
• D.Four

Comment: *

Name: *

Email: *

Verification: *

Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

• A.User = smith
• B.Username NOT END WITH jsmith
• C.User IS jsmith
• D.Username CONTAIN smit

Comment: *

Name: *

Email: *

Verification: *