FCSS_ADA_AR-6.7 Exam Dumps : FCSS Advanced Analytics 6.7 Architect

From theFilterssection in the exhibit, we see:

1.Event Type IN EventTypes: Domain Account Locked

This means the rule will match events where the event type is classified under theDomain Account Lockedcategory.

2.Reporting IP IN Applications: Domain Controller

This means the rule is filtering for events where the reporting IP is classified under theDomain Controller applications group.

3.Logical Operator: AND

The filters are combined usingAND, meaning both conditions must be met for an event to match.

Since both conditions must be true, the rule is effectively filtering events where:

● Theevent typebelongs to theDomain Account Locked CMDB group

● Thereporting IPbelongs to theDomain Controller applications group

FortiSIEM enforces a device limit based on licensing and system-wide constraintsto ensure proper resource allocation and performance management.

The device limit is determined by the purchased license.

● FortiSIEM licensing includes limits on thenumber of devicesthat can be monitored.

● Thelicense type(e.g.,Enterprise vs. Service Provider) defines themaximum number of devicessupported.

For Service Provider editions, the device limit applies system-wide and is shared across all customers.

● In anMSSP (Managed Security Service Provider) setup, the totaldevice limit applies across all customers, rather than being allocated individually.

● This allowsflexible resource allocationbased on customer needs.

Lookup tables and watchlists serve different purposes in Fortinet’s Advanced Analytics:

● Lookup tables allow for structured data storage with multiple columns, making them useful for correlating different attributes or key-value pairs.

● Watchlists are simpler and contain only a single column, often used for quick reference to flagged values, such as IP addresses or user accounts.