NSE5_FSM-6.3 Exam Dumps - Fortinet NSE 5 Network Security Analyst Questions and Answers

 Grouping Attributes in Reports: When creating reports in FortiSIEM, certain attributes can be grouped to summarize and organize the data.

 Unique Attributes: Attributes that are unique for each event cannot be grouped because they do not provide a meaningful aggregation or summary.

 Red Highlighting Explanation: The red highlighting in the exhibit indicates attributes that cannot be grouped together due to their unique nature. These unique attributes includeEvent Receive Time,Reporting IP,Event Type,Raw Event Log, andCOUNT(Matched Events).

 Attribute Characteristics:

Event Receive Timeis unique for each event.

Reporting IPandEvent Typecan vary greatly, making grouping them impractical in this context.

Raw Event Logrepresents the unprocessed log data, which is also unique.

COUNT(Matched Events)is a calculated field, not suitable for grouping.

 References: FortiSIEM 6.3 User Guide, Reporting section, explains the constraints on grouping attributes in reports.

 Incident Creation in FortiSIEM: Incidents in FortiSIEM are created based on specific patterns and conditions defined within the system.

 Group By Function: The "Group By" section in the "Edit SubPattern" window specifies how the data should be grouped for analysis and incident creation.

 Impact of Grouping: The way data is grouped affects the number of incidents generated. Each unique combination of the grouped attributes results in a separate incident.

 Exhibit Analysis: In the provided exhibit, the "Group By" section lists "Reporting Device," "Reporting IP," and "User." This means incidents will be created for each unique combination of these attributes.

 References: FortiSIEM 6.3 User Guide, Rule and Pattern Creation section, which details how grouping impacts incident generation.

 Incident Status in FortiSIEM: The status of an incident indicates its current state and helps administrators track and manage incidents effectively.

 Cleared Status: When an incident’s status is "Cleared," it means that a specific condition set to clear the incident has been satisfied.

Clear Condition: This is typically a predefined condition that indicates the issue causing the incident has been resolved or no longer exists.

 Automatic vs. Manual Clearance: While some incidents may be cleared automatically based on clear conditions, others might be manually cleared by an operator.

 References: FortiSIEM 6.3 User Guide, Incident Management section, detailing the various incident statuses and the conditions that lead to an incident being marked as "Cleared."

 Incident Categories in FortiSIEM: Incidents in FortiSIEM are categorized to help administrators quickly identify and prioritize the type of issue.

 Four Main Categories:

Performance: Incidents related to the performance of devices and applications, such as high CPU usage or memory utilization.

Availability: Incidents affecting the availability of services or devices, such as downtime or connectivity issues.

Security: Incidents related to security events, such as failed login attempts, malware detection, or unauthorized access.

Change: Incidents triggered by changes in the configuration or state of devices, such as new software installations or configuration modifications.

 Importance of Categorization: These categories help in the efficient management and response to different types of incidents, allowing for better resource allocation and quicker resolution.

 References: FortiSIEM 6.3 User Guide, Incident Management section, which details the different categories of incidents and their significance.

 Linux Agent in FortiSIEM: The FortiSIEM Linux agent is responsible for collecting logs and metrics from Linux devices and forwarding them to the FortiSIEM system.

 Command for Checking Status: The correct command to check the status of the FortiSIEM Linux agent isservice fortisiem-linux-agent status.

Explanation: This command queries the status of the FortiSIEM Linux agent service, showing whether it is running, stopped, or encountering issues.

 Usage: Properly checking the agent status helps ensure that data collection from Linux devices is functioning as expected.

 References: FortiSIEM 6.3 User Guide, Linux Agent Installation and Management section, which includes commands for managing the Linux agent.

 Incident Status Values: Incident statuses in FortiSIEM help administrators track and manage the lifecycle of incidents from detection to resolution.

 Four Possible Status Values:

Active: Indicates that the incident is currently ongoing and needs attention.

Closed: Indicates that the incident has been resolved or addressed.

Cleared: Indicates that the incident has been resolved automatically based on predefined conditions.

Open: Indicates that the incident is acknowledged and under investigation but not yet resolved.

 Usage: These statuses help in prioritizing and tracking incidents effectively, ensuring that all incidents are appropriately managed.

 References: FortiSIEM 6.3 User Guide, Incident Management section, which details the different status values and their meanings.

 Expression Builder in FortiSIEM: The Expression Builder is used to create expressions for analyzing event data.

 Correct Syntax: The correct syntax for counting matched events isCOUNT(Matched Events).

Function:COUNTis a function that takes a parameter, in this case, "Matched Events," to count the number of occurrences.

 Common Errors: Incorrect syntax, such as reversing the order or using parentheses improperly, can lead to invalid expressions.

 References: FortiSIEM 6.3 User Guide, Expression Builder section, which explains the correct syntax and usage for creating valid expressions for event analysis.

 Grouping Events: Grouping events by specific attributes allows for the aggregation of similar events.

 Grouping Criteria: For this question, events are grouped by "Reporting IP," "Event Type," and "User."

 Unique Combinations Analysis:

10.10.10.10, Failed Logon, Ryan, 1.1.1.1, Web App

10.10.10.11, Failed Logon, John, 5.5.5.5, DB

10.10.10.10, Failed Logon, Ryan, 1.1.1.1, Web App(duplicate, counted as one unique result)

10.10.10.10, Failed Logon, Paul, 3.3.2.1, Web App

10.10.10.11, Failed Logon, Ryan, 1.1.1.15, DB

10.10.10.11, Failed Logon, Wendy, 1.1.1.6, DB

10.10.10.10, Failed Logon, Ryan, 1.1.1.15, DB

 Result Calculation: There are seven unique combinations based on the specified grouping attributes.

 References: FortiSIEM 6.3 User Guide, Event Management and Reporting sections, explaining how events are grouped and reported based on selected attributes.

 Event Collection Overview: The exhibits show three events collected over a 10-minute period from two servers, Server A and Server B.

 Rule Subpattern Settings: The rule subpattern specifies two conditions:

AVG(CPU Util) > DeviceToCMDBAttr(Host IP : Server CPU Util Critical Threshold): This checks if the average CPU utilization exceeds the critical threshold defined for each server.

COUNT(Matched Events) >= 2: This requires at least two matching events within the specified period.

 Server A Analysis:

Events: Three events (CPU=90, CPU=90, CPU=95).

Average CPU Utilization: (90+90+95)/3 = 91.67, which exceeds the critical threshold of 90.

Matched Events Count: 3, which meets the condition of being greater than or equal to 2.

Incident Generation: Server A meets both conditions, so it generates one incident.

 Server B Analysis:

Events: Three events (CPU=70, CPU=50, CPU=60).

Average CPU Utilization: (70+50+60)/3 = 60, which does not exceed the critical threshold of 90.

Matched Events Count: 3, but since the average CPU utilization condition is not met, no incident is generated.

 Conclusion: Based on the rule subpattern, Server A will generate one incident, and Server B will not generate any incidents.

 References: FortiSIEM 6.3 User Guide, Event Correlation Rules and Incident Management sections, which explain how incidents are generated based on rule subpatterns and event conditions.

 Case Sensitivity in Searches: In FortiSIEM, search queries, including those for raw event logs, are case sensitive. This means that keywords must be entered exactly as they appear in the logs.

 Keyword Mismatch: The exhibit shows the keyword "TCP" in the Value field. If the actual events use "tcp" (lowercase), the search will return no results because of the case mismatch.

 Correct Keyword: To match the keyword correctly, the administrator should enter "tcp" in the Value field.

 References: FortiSIEM 6.3 User Guide, Search and Filtering section, which discusses the importance of case sensitivity in search queries.