FCSS_ADA_AR-6.7 Exam Dumps : FCSS Advanced Analytics 6.7 Architect

From theFilterssection in the exhibit, we see:

1.Event Type IN EventTypes: Domain Account Locked

This means the rule will match events where the event type is classified under theDomain Account Lockedcategory.

2.Reporting IP IN Applications: Domain Controller

This means the rule is filtering for events where the reporting IP is classified under theDomain Controller applications group.

3.Logical Operator: AND

The filters are combined usingAND, meaning both conditions must be met for an event to match.

Since both conditions must be true, the rule is effectively filtering events where:

● Theevent typebelongs to theDomain Account Locked CMDB group

● Thereporting IPbelongs to theDomain Controller applications group

InFortiSIEM,SQLite databasesused forbaseliningare stored in the/opt/phoenix/cachedirectory. This location is used fortemporary storage and caching of profile datathat is essential for anomaly detection and trend analysis.

●Baselininginvolves analyzing historical data to determine expected behavior patterns.

●SQLite databasesstore aggregated statistics, which are referenced during rule evaluations.

● Thecache directoryallows quick access to these values without querying the main database repeatedly.

Total EPS License Purchased: 500 EPS

Allocated EPS:

● Customer A: 100 EPS

● Customer B: 200 EPS

Remaining EPS Pool:

500 − (100 + 200) = 200 EPS