Fortinet NSE6_FSM_AN-7.4 Exam Questions

The attribute must be selected as a Triggered Attribute so that it becomes available for incident generation and incident-title substitution. In the FortiSIEM Study Guide's rule action configuration section, FortiSIEM separates incident attributes from triggered attributes. Triggered attributes are taken from the events that cause the rule to trigger and are then available for incident display and incident context. The guide explains that the rule action step is where an analyst defines the incident generated by a rule and chooses which attributes are carried forward. If Destination Host Name is not selected in the Triggered Attributes list, FortiSIEM cannot use it as an incident attribute in the generated incident title. Option B is wrong because aggregate items are used for calculations such as COUNT, AVG, or SUM, not for making a text attribute available in the incident title. Option C is wrong because Destination Host Name is an event attribute, not an event type. Option D is unrelated; removing Destination IP would not make Destination Host Name selectable.

The correct answers are A. Process and C. Resources. FortiSIEM UEBA/EBA analytics uses endpoint and behavior-related telemetry to identify abnormal activity. The Study Guide explains that the UEBA incident dashboard shows incidents that the AI module creates based on alerts received from FortiInsight. The UEBA attribute list includes the incident name, host, application, user, tag, and activity. This aligns with process-oriented activity monitoring from endpoint agents. The performance and baseline lessons also explain that FortiSIEM collects performance and availability data from devices and applications, including resource-utilization metrics, and uses that information to build baselines and detect anomalous activity. Resource behavior includes CPU, memory, disk, I/O, and similar utilization patterns, which are valid behavioral-model inputs. Location and Network are important FortiSIEM context areas, but in this question's EBA machine learning model choices, the valid model areas are process behavior and resource behavior. Process reflects what is running or being executed; Resources reflects system or application utilization behavior. Together, these are the two data areas used for EBA machine learning models.

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide's rule and subpattern example states that when multiple events have the same Group By values, ''they are grouped together in one row, and the count column tracks the number of events for each of those rows.'' In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination: FW01 / 10.1.1.1 / DB. Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

The automation policy is configured to run a remediation script named 'Fortinet FortiOS - Block Source IP FortiOS via API'. It specifies enforcement on two FortiGate devices: FortiGate508 and FortiGate90D. Therefore, associated source IP addresses will be blocked on those two FortiGate firewalls only.

The correct answer is D because the remediation configuration defines specific enforcement targets. The FortiSIEM Study Guide explains that automation policies can run remediation scripts automatically when an incident occurs. It also explains the remediation options: Enforce On determines which devices the script runs against, while Run On identifies whether the script is launched from the supervisor or a collector. The Study Guide further states that mitigation scripts can block an IP address in a firewall or disable a user in Active Directory, and recommends specifying the Enforce On value because it controls the target device used by the remediation script. In the exhibit, the selected script is a Fortinet FortiOS block-source-IP remediation script, and the Enforce On field lists two FortiGate devices. That means the block action is targeted only at those two named FortiGate firewalls. The Aviation organization limits the automation policy context, but it does not mean every device in the organization receives the block. It is also not all FortiGate firewalls or the whole Network CMDB group.

The FortiSIEM Study Guide defines a nested query as a query that has another query embedded within it, where the embedded query is known as the subquery. The FortiSIEM 7.4 User Guide lists the supported nested search scenarios: Outer CMDB Query, Inner Event Query; Outer Event Query, Inner Event Query; and Outer Event Query, Inner CMDB Query. These supported combinations prove that the inner or subquery can be either an Event Query or a CMDB Query. LDAP Query and SNMP Query are not listed as supported nested analytics subquery types. LDAP may be used for user discovery or authentication, and SNMP may be used for monitoring or discovery, but neither is referenced as a nested analytics query type. The User Guide also explains that the outer query uses Select from Report to reference the saved inner query and that the matching attribute data types must align between the outer query and the selected display column in the inner query.