Fortinet NSE7_SOC_AR-7.6 - Fortinet NSE 7 - Security Operations 7.6 Architect

Exact Extract: “If there is more than one subpattern, you must specify the logic between the subpatterns and define the subpattern relationship and constraints.”

Exact Extract: “FortiSIEM also supports rules with multiple subpatterns… Subpattern X was FOLLOWED BY subpattern Y within the time window.”

Exact Extract: “This slide shows a multiple subpattern rule. The rule contains two subpatterns… with a FOLLOWED_BY operator… To ensure FortiSIEM is correlating the proper logs… [matching fields] must match. This is the relationship, also called a constraint, between the two subpatterns.”

The correct answers are C, D, and E . You need two subpatterns because the detection contains two different event patterns: repeated failed logins and a later successful login. You then need FOLLOWED_BY because the successful login must occur after the failed-login sequence, not merely within the same time range. Finally, you must define subpattern relationships and constraints , matching source IP address and user, so FortiSIEM does not correlate failed logins from one user or host with a successful login from a different user or host. A is wrong because failed-login and successful-login subpatterns normally require different filters and often different aggregate thresholds. B is not the best answer as written because the key requirement is the rule/subpattern relationship within the 15-minute correlation window, not simply assigning independent time windows to each subpattern.

Technical Deep Dive: The clean FortiSIEM logic is: failed-login subpattern with an aggregate such as COUNT(Matched Events) > = N, success-login subpattern with COUNT(Matched Events) > = 1, a FOLLOWED_BY operator, and constraints like FailedLogin Source IP = SuccessLogin Source IP and FailedLogin User = SuccessLogin User. The time window should represent 15 minutes, usually 900 seconds. This is correlation-engine behavior; FortiGate NP/CP hardware offload has no role because FortiSIEM is analyzing normalized log events, not accelerating packet forwarding.

Exact Extract: “Attribute: Event Type Operator: IN Value: EventTypes: Logon Failure.” The same section explains that when selecting a group from the CMDB, “the value displays Group: < Name > when you select the group from CMDB initially.”

The correct answer is B because FortiSIEM uses the IN operator when a search condition references a CMDB group or category. In this case, the value is Group: Logon Success , meaning the query is not matching one literal event type string; it is matching membership in a CMDB event type category. Therefore, the condition should be configured as Event Type IN Group: Logon Success . CONTAIN is for substring matching, such as checking whether a text field contains a word. IS or exact equality-style logic would be appropriate for a single specific value, not a CMDB group. HAS is not the correct operator for matching Event Type membership in a CMDB category.

Technical Deep Dive: In FortiSIEM analytics, CMDB-backed values are object groups, not simple strings. The IN operator tells FortiSIEM to expand the selected CMDB group and match any event type inside that category. This is cleaner than manually adding many Event Type OR conditions. For example, a “Logon Success” group can include multiple normalized success-login event types across Windows, VPN, Unix, and other sources. This is SIEM query logic only; NP/CP ASIC offloading does not apply because FortiSIEM is searching normalized event data, not processing FortiGate traffic flows.

Understanding Playbook Triggers :

Playbook triggers are the starting points for automated workflows within FortiAnalyzer or FortiSOAR.

These triggers determine how and when a playbook is executed and can pass relevant information (trigger variables) to subsequent tasks within the playbook.

Types of Playbook Triggers :

EVENT Trigger :

Initiates the playbook when a specific event occurs.

The event details can be used as variables in later tasks to customize the response.

Selected as it allows using event details as trigger variables.

INCIDENT Trigger :

Activates the playbook when an incident is created or updated.

The incident details are available as variables in subsequent tasks.

Selected as it enables the use of incident details as trigger variables.

ON SCHEDULE Trigger :

Executes the playbook at specified times or intervals.

Does not inherently use trigger events to pass variables to later tasks.

Not selected as it does not involve passing trigger event details.

ON DEMAND Trigger :

Runs the playbook manually or as required.

Does not automatically include trigger event details for use in later tasks.

Not selected as it does not use trigger events for variables.

Implementation Steps :

Step 1 : Define the conditions for the EVENT or INCIDENT trigger in the playbook configuration.

Step 2 : Use the details from the trigger event or incident in subsequent tasks to customize actions and responses.

Step 3 : Test the playbook to ensure that the trigger variables are correctly passed and utilized.

Conclusion :

EVENT and INCIDENT triggers are specifically designed to initiate playbooks based on specific occurrences, allowing the use of trigger details in subsequent tasks.

Step 1: FortiSIEM event log

Step 2: FortiSIEM incident

Step 3: FortiSOAR alert

Step 4: FortiSOAR incident

Exact Extract: “FortiSIEM: Event: An event refers to a single log or data point collected from a monitored device. It’s the most basic unit of information received by FortiSIEM, such as a firewall log or a system alert.” The guide also states: “Incident: An incident in FortiSIEM is created when a correlation rule is triggered.”

Exact Extract: “This slide explains how to map fields between FortiSIEM incidents and FortiSOAR alerts during the ingestion process. Use the wizard to define how FortiSIEM data populates FortiSOAR alert fields.”

Exact Extract: “FortiSOAR ingests FortiSIEM incidents as alerts… If the alert is not a valid threat, then the analyst can close it as a false positive. Otherwise, the analyst can open an incident.”

The correct sequence is FortiSIEM event log → FortiSIEM incident → FortiSOAR alert → FortiSOAR incident . FortiSIEM first receives raw event logs from monitored devices. If those events match a correlation rule, FortiSIEM creates a FortiSIEM incident . The FortiSOAR default data ingestion wizard then ingests FortiSIEM incidents into FortiSOAR as alerts , not as FortiSOAR incidents directly. After triage and validation, the analyst or playbook can escalate the alert into a FortiSOAR incident .

Technical Deep Dive: FortiSIEM and FortiSOAR use different object models. FortiSIEM “incident” means a correlation result from event analytics. FortiSOAR “alert” is the first SOAR-side record created from that SIEM incident. FortiSOAR “incident” is a higher-level case-management container used after validation. This separation is intentional: not every SIEM incident deserves full incident-response handling. FortiGate NP/CP offloading is irrelevant because this workflow is log ingestion and case orchestration, not firewall packet acceleration.

Understanding the Requirements :

The objective is to create an incident and generate a report based on malicious attachment events detected by FortiAnalyzer from FortiSandbox analysis.

The endpoint hosts are protected by FortiClient EMS, which is integrated with FortiSandbox. All logs are sent to FortiAnalyzer.

Key Components :

FortiAnalyzer : Centralized logging and analysis for Fortinet devices.

FortiSandbox : Advanced threat protection system that analyzes suspicious files and URLs.

FortiClient EMS : Endpoint management system that integrates with FortiSandbox for endpoint protection.

Playbook Analysis :

The playbook in the exhibit consists of three main actions: GET_EVENTS, RUN_REPORT, and CREATE_INCIDENT.

EVENT_TRIGGER : Starts the playbook when an event occurs.

GET_EVENTS : Fetches relevant events.

RUN_REPORT : Generates a report based on the events.

CREATE_INCIDENT : Creates an incident in the incident management system.

Selecting the Correct Connector :

The correct connector should allow fetching events related to malicious attachments analyzed by FortiSandbox and facilitate integration with FortiAnalyzer.

Connector Options :

FortiSandbox Connector :

Directly integrates with FortiSandbox to fetch analysis results and events related to malicious attachments.

Best suited for getting detailed sandbox analysis results.

Selected as it is directly related to the requirement of handling FortiSandbox analysis events.

FortiClient EMS Connector :

Used for managing endpoint security and integrating with endpoint logs.

Not directly related to fetching sandbox analysis events.

Not selected as it is not directly related to the sandbox analysis events.

FortiMail Connector :

Used for email security and handling email-related logs and events.

Not applicable for sandbox analysis events.

Not selected as it does not relate to the sandbox analysis.

Local Connector :

Handles local events within FortiAnalyzer itself.

Might not be specific enough for fetching detailed sandbox analysis results.

Not selected as it may not provide the required integration with FortiSandbox.

Implementation Steps :

Step 1 : Ensure FortiSandbox is configured to send analysis results to FortiAnalyzer.

Step 2 : Use the FortiSandbox connector in the playbook to fetch events related to malicious attachments.

Step 3 : Configure the GET_EVENTS action to use the FortiSandbox connector.

Step 4 : Set up the RUN_REPORT and CREATE_INCIDENT actions based on the fetched events.

Step 1: Create a parameter in the child playbook.

Step 2: Map data to the parameter in the Reference a Playbook step in the parent playbook.

Step 3: Apply the parameter to the Disable User Account connector action.

Exact Extract: “To make the child playbook function properly, you must pass information from the parent playbook to the child playbook. If the child playbook is not aware of the AD user queried in the parent playbook, the action to disable a user cannot be completed. The easiest way to accomplish this task is to create a parameter in the child playbook.”

Exact Extract: “After it is created, you can go back to your parent playbook to the Reference a Playbook step for the associated child playbook. You will find a new field to map data to. After the data is mapped in the parent playbook, when you return to the child playbook, you can see the parameter is available in the Dynamic Values window.”

The correct order is child parameter → parent mapping → child connector usage . The child playbook must first expose an input parameter, such as user_name, because a referenced child playbook does not automatically inherit every variable from the parent workflow. After the child parameter exists, the parent playbook’s Reference a Playbook step displays that parameter as a mappable input field. The parent can then pass the AD username discovered earlier in the workflow. Finally, inside the child playbook, that parameter is selected from Dynamic Values and applied to the Disable User Account Active Directory connector action.

The option “Create a parameter in the parent playbook” is not required. The parent only maps data into the child’s parameter. The option “Create a manual trigger and assign the user to a new variable” is also wrong because the parent playbook in the exhibit already starts from an On Create trigger and already retrieves the AD account details before referencing the child playbook.

Technical Deep Dive: Referenced playbooks are modular automation units. Their clean design depends on explicit input parameters, just like function arguments in programming. This avoids brittle dependencies on parent-step variable names and allows the same child playbook to be reused by multiple parent workflows. Hardware offloading such as FortiGate NP/CP acceleration is irrelevant here because this is FortiSOAR workflow orchestration, not FortiGate data-plane traffic processing.

According to the FortiAnalyzer 7.4 SOC Analyst official training material (Lesson 5: Automation) and supporting documentation for FortiSOAR 7.6 and FortiSIEM 7.3 integration, the following best practices are recommended for playbook portability:

Disable playbooks before exporting (A): When a playbook is exported, its current status (Enabled or Disabled) is preserved in the export file. If an Enabled playbook is imported into a destination ADOM where its trigger conditions are immediately met, it will start executing automatically. Disabling the playbook before export is a critical best practice to prevent unintended automated actions from occurring in the new environment before the analyst has had a chance to verify local configurations.

Include the associated connector settings (B): FortiAnalyzer allows you to include required connector configurations during the export process. By selecting this option, the exported file includes the necessary metadata and configurations for the connectors that the playbook relies on to execute its tasks. This ensures the playbook remains functional and portable across different FortiAnalyzer units or ADOMs without requiring the manual recreation of every connector.

Why other options are incorrect:

Move playbooks between ADOMs (C): There is no native " Move " function for automation playbooks between ADOMs in the same sense as moving a device. The standard supported workflow for transferring automation logic is the Export and Import process.

Ensure names do not exist in target (D): While maintaining unique names is good practice, it is not a required " best practice " for the export process itself because FortiAnalyzer automatically handles name conflicts. If an imported playbook shares a name with an existing one, the system automatically appends a timestamp to the new playbook ' s name to avoid a conflict.

Exact Extract: “Next, they will use SSH tunneling to bypass firewall rules that prevent LAN devices from accessing some devices in the SOC network. They will be able to gain access to crucial network infrastructure.”

The correct answer is D. Protocol tunneling . The exhibit shows the compromised PC using SSH to connect to a permitted intermediary system—the engineering build server—and then using that path to relay HTTPS traffic toward internal servers that the LAN host could not normally access directly. That is tunneling: one protocol or traffic flow is encapsulated or relayed through another allowed channel to bypass segmentation or firewall policy.

A is wrong because port knocking is a stealth access-control mechanism where a sequence of connection attempts opens a port. B is wrong because the exhibit is about reaching internal servers, not stealing data through an established C2 channel. C is wrong because there is no interception or manipulation of traffic between two victims; the build server is being used as a pivot/tunnel.

Technical Deep Dive: In MITRE terms, this behavior aligns with tunneling/proxy-style defense evasion and lateral movement support. In real operations, an attacker may use SSH local forwarding, remote forwarding, or dynamic SOCKS proxying, for example ssh -L 8443:internal-server:443 user@build-server or ssh -D 1080 user@build-server. From a Fortinet SOC perspective, FortiSIEM should flag unusual SSH sessions from workstations to build servers, followed by unexpected HTTPS connections from the build server to protected server zones. FortiGate NP/CP offload may accelerate allowed sessions, but the detection value comes from log correlation and segmentation policy violations, not ASIC behavior.

Understanding the MITRE ATT & CK Matrix:

The MITRE ATT & CK framework is a knowledge base of adversary tactics and techniques based on real-world observations.

Each tactic in the matrix represents the " why " of an attack technique, while each technique represents " how " an adversary achieves a tactic.

Analyzing the Provided Exhibit:

The exhibit shows part of the MITRE ATT & CK Enterprise matrix as displayed on FortiAnalyzer.

The focus is on technique T1071 (Application Layer Protocol), which has subtechniques labeled T1071.001, T1071.002, T1071.003, and T1071.004.

Each subtechnique specifies a different type of application layer protocol used for Command and Control (C2):

T1071.001 Web Protocols

T1071.002 File Transfer Protocols

T1071.003 Mail Protocols

T1071.004 DNS

Identifying Key Points:

Subtechniques under T1071: There are four subtechniques listed under the primary technique T1071, confirming that statement B is true.

Event Handlers for T1071: FortiAnalyzer includes event handlers for monitoring various tactics and techniques. The presence of event handlers for tactic T1071 suggests active monitoring and alerting for these specific subtechniques, confirming that statement C is true.

Misconceptions Clarified:

Statement A (four techniques under tactic T1071) is incorrect because T1071 is a single technique with four subtechniques.

Statement D (15 events associated with the tactic) is misleading. The number 15 refers to the techniques under the Application Layer Protocol, not directly related to the number of events.

Conclusion:

The accurate interpretation of the exhibit confirms that there are four subtechniques under technique T1071 and that there are event handlers covering tactic T1071.