Fortinet NSE6_FSM_AN-7.4 - Fortinet NSE 6 - FortiSIEM 7.4 Analyst

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide’s rule and subpattern example states that when multiple events have the same Group By values, “they are grouped together in one row, and the count column tracks the number of events for each of those rows.” In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination: FW01 / 10.1.1.1 / DB . Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

The correct answer is C. CMDB user group . In FortiSIEM, users and user groups are maintained as CMDB objects and can be referenced in analytics filters and rule logic. The FortiSIEM 7.4 User Guide table of contents explicitly includes CMDB management for users, viewing user information, adding users, editing or deleting users, performing operations on users, and working with user groups. This confirms that user groups are part of the FortiSIEM CMDB data model. The query shown in the exhibit uses the Analytics filter with the User attribute and the value Group: FortiSIEM Analysts . That syntax indicates that FortiSIEM is referencing a FortiSIEM-defined user group from CMDB, not an LDAP group directly and not an Active Directory group directly. LDAP and Active Directory can be used to discover or authenticate users, but once referenced as a FortiSIEM analytics group value, the object is a CMDB user group. FortiSIEM organization groups are tenant/organization constructs and are not the same as CMDB user groups.

The time period must be defined under the Define Condition tab of the rule. The FortiSIEM Study Guide states that a rule has three components: General , Condition , and Action . The General section defines the overall purpose and scope of the rule, the Condition section specifies which conditions trigger the rule, and the Action section configures what happens after the rule is triggered. The Study Guide further explains that on the Define Condition page, FortiSIEM specifies “the conditions—event attributes and thresholds—that will trigger the rule and create an incident,” including “the time window” within which the subpatterns must match for the rule condition to be satisfied. It also states that when there is more than one subpattern, you must define the logic between subpatterns and their relationships or constraints.

For a 24-hour multiple-subpattern rule, the guide gives an example using an 86400-second time window, which equals 24 hours, and shows it under Resource > Rules > Define Condition. Therefore, the time period is not configured inside each individual subpattern, not under General, and not under Define Action.

The correct answer is C. Regression. Regression is the machine learning task used when a model predicts a target value based on other fields in a dataset. In FortiSIEM’s machine learning workflow, regression configuration includes selecting Fields to use for Prediction and a Field to Predict. The User Guide explains that during regression training, the analyst chooses the fields used for prediction and the field being predicted, then trains the model with a Train factor. This matches the question exactly: the model predicts a target based on other fields, and the inference phase can identify anomalies when observed values differ significantly from predicted values. Classification is used to assign records to discrete classes or categories, not to predict a continuous target metric from other variables. Clustering groups similar observations without a predefined target field. Forecasting predicts future values over time, normally based on time-series behavior. Because the question specifically describes predicting a target field from other dataset fields and detecting mismatch from the prediction, the correct machine learning method is Regression.

The attribute must be selected as a Triggered Attribute so that it becomes available for incident generation and incident-title substitution. In the FortiSIEM Study Guide’s rule action configuration section, FortiSIEM separates incident attributes from triggered attributes. Triggered attributes are taken from the events that cause the rule to trigger and are then available for incident display and incident context. The guide explains that the rule action step is where an analyst defines the incident generated by a rule and chooses which attributes are carried forward. If Destination Host Name is not selected in the Triggered Attributes list, FortiSIEM cannot use it as an incident attribute in the generated incident title. Option B is wrong because aggregate items are used for calculations such as COUNT, AVG, or SUM, not for making a text attribute available in the incident title. Option C is wrong because Destination Host Name is an event attribute, not an event type. Option D is unrelated; removing Destination IP would not make Destination Host Name selectable.

A FortiSIEM rule requires detection logic and at least one subpattern structure to evaluate matching events. The FortiSIEM Study Guide explains that a single subpattern rule example consists of filter, aggregate, and group-by sections. It states: “The subpattern, ExcessVPNLoginFailure, consists of three components: Filter, Aggregate, Group By.” That confirms that a subpattern is a core rule component. The FortiSIEM 7.4 User Guide also identifies Detection Technology as part of rule definition and built-in rule metadata. Detection Technology describes the detection method used by the rule, such as correlation, profiling, machine learning, or correlation using lookup tables. Exception policy is not required; it is used to suppress or tune matches under specific conditions. Clear policy is also not required; it controls how an incident can be cleared or auto-cleared after triggering. Therefore, the required components among the listed options are Subpattern and Detection Technology. Without them, the rule lacks both the event-detection structure and the detection-method classification needed for rule evaluation.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

The correct answer is A. The FortiSIEM Study Guide explicitly lists Create Rule as one of the actions that can be performed directly from Analytics search results. The guide states that to perform actions on results, an analyst clicks Actions and can choose options such as Email Result, Export Result, Add Result to Case, Copy To New Tab, Save Report, and Create Rule. The rules lesson further explains what happens after clicking Create Rule: FortiSIEM opens a new rule configuration window and creates a subpattern based on the analytics search parameters. It states that FortiSIEM uses the analytics search filter conditions to create the rule subpattern filter conditions, uses the search display conditions to create the rule Group By conditions, and sets the Aggregate condition to COUNT(Matched Events) > = 1. Creating a new rule manually under Resources > Rules would work, but it is slower because the analyst must manually re-enter the search criteria. The direct Analytics > Actions > Create Rule workflow is the quickest method.

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide’s anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference. Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.