FCP_FSM_AN-7.2 FCP - FortiSIEM 7.2 Analyst Questions and Answers

User = smith

Username NOT END WITH jsmith

User IS jsmith

Username CONTAIN smit

No notification is sent.

An email is sent to the SOC manager.

The remediation script is run.

A notification is sent to the SOC manager dashboard.

The Event Type refers to a CMDB lookup and should be an Event lookup.

The Destination Host Name value is not fully qualified.

The Group By attributes restricts which events are counted.

The Aggregate attribute is too restrictive.

FortiSIEM runs the remediation script, because that takes precedence over all other options.

FortiSIEM performs all selected actions.

FortiSIEM fails to the integration policy, because no policy is defined.

FortiSIEM sends an email, because that is first on the list.

FortiSIEM organization group

LDAP user group

CMDB user group

Windows Active Directory user group

The Train factor must be 70% or greater.

Run Mode must be set to ML.

Only one AVG type field must be selected under Fields to use for Prediction.

The selection in Fields to use for Prediction and Field to Predict must match.