Free Preparation Discussions
MENU
Fortinet NSE7_SOC_AR-7.6 Exam - Topic 4 Question 10 Discussion
Topic #: 4
A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected.
Which FortiAnalyzer feature must you use to start this automation process?
Understanding Automation Processes in FortiAnalyzer:
FortiAnalyzer can automate responses to detected security events, such as running commands on FortiGate devices.
Analyzing the Customer Requirement:
The customer wants to run a CLI command on FortiGate to block predefined URLs when a botnet C&C server IP is detected.
This requires an automated response triggered by a specific event.
Evaluating the Options:
Option A: Playbooks orchestrate complex workflows but are not typically used for direct event-triggered automation processes.
Option B: Data selectors filter logs based on criteria but do not initiate automation processes.
Option C: Event handlers can be configured to detect specific events (such as detecting a botnet C&C server IP) and trigger automation stitches to execute predefined actions.
Option D: Connectors facilitate communication between FortiAnalyzer and other systems but are not the primary mechanism for initiating automation based on log events.
Conclusion:
To start the automation process when a botnet C&C server IP is detected, you must use an Event handler in FortiAnalyzer.
Fortinet Documentation on Event Handlers and Automation Stitches in FortiAnalyzer.
Best Practices for Configuring Automated Responses in FortiAnalyzer.
Eulah
17 hours agoRenea
6 days agoMelodie
11 days agoGerald
16 days agoRashida
21 days agoIluminada
27 days agoMelissa
1 month agoCraig
1 month agoCristen
1 month agoLorean
2 months agoTesha
2 months agoSabra
2 months agoTeddy
2 months agoCory
2 months agoXuan
2 months agoJuan
3 months agoRenay
4 months ago