From theFilterssection in the exhibit, we see:

1.Event Type IN EventTypes: Domain Account Locked

This means the rule will match events where the event type is classified under theDomain Account Lockedcategory.

2.Reporting IP IN Applications: Domain Controller

This means the rule is filtering for events where the reporting IP is classified under theDomain Controller applications group.

3.Logical Operator: AND

The filters are combined usingAND, meaning both conditions must be met for an event to match.

Since both conditions must be true, the rule is effectively filtering events where:

● Theevent typebelongs to theDomain Account Locked CMDB group

● Thereporting IPbelongs to theDomain Controller applications group

FortiSIEM enforces a device limit based on licensing and system-wide constraintsto ensure proper resource allocation and performance management.

The device limit is determined by the purchased license.

● FortiSIEM licensing includes limits on thenumber of devicesthat can be monitored.

● Thelicense type(e.g.,Enterprise vs. Service Provider) defines themaximum number of devicessupported.

For Service Provider editions, the device limit applies system-wide and is shared across all customers.

● In anMSSP (Managed Security Service Provider) setup, the totaldevice limit applies across all customers, rather than being allocated individually.

● This allowsflexible resource allocationbased on customer needs.

In FortiSIEM, an agent’s status of "Running Inactive" indicates that the agent is installed and running but not actively sending data or has encountered a misconfiguration. The following reasons can cause this status:

1. The agent was registered incorrectly

If an agent was not registered properly, it might not establish a proper connection with the FortiSIEM system, resulting in an inactive status.

2. The agent is temporarily down

If the agent goes offline (e.g., due to system shutdown, network issues, or agent crash), it will show as inactive.

3. The template was not assigned

Agents require a template to function correctly. If no template is assigned, the agent cannot collect or process events, leading to an inactive state.