FCSS_ADA_AR-6.7 Exam Dumps : FCSS Advanced Analytics 6.7 Architect

The administratordeployed FortiSIEM without a collector, meaning there is no dedicated system collecting logs fromservice provider infrastructure devices. Without a collector, the FortiSIEMsupervisor and workersmust directly ingest logs, which is not ideal for amulti-tenant service provider setup. Acollector is necessaryto efficiently gather logs before forwarding them to the FortiSIEM cluster.

InFortiSIEM baselining, anhourly bucketis used to maintainhourly-specific statistical baselines. This helps detect anomalies by comparing current activity against historical norms foreach hour of the day, separately forweekdays and weekends.

The system maintainshourly profiles, ensuring that anomalies are detected based on similar timeframes. This approach prevents false positives due to natural variations in network activity across different times of the day and different days of the week.

These three processes are essential for aFortiSIEM collector, as they handle event parsing, agent communication, and system monitoring.

●phParseris responsible forparsing and processing collected logsbefore forwarding them.

●phAgentManagermanages agent communication, ensuring logs are received and forwarded correctly.

●phMonitorAgentmonitors the health of the collector itself, reporting system status to the FortiSIEM supervisor.

phReportMasterandphRuleMasterdo not run on collectors. They are supervisor/worker processes handling reporting and rule evaluation, respectively.