FCSS_ADA_AR-6.7 Exam Dumps : FCSS Advanced Analytics 6.7 Architect

From theFilterssection in the exhibit, we see:

1.Event Type IN EventTypes: Domain Account Locked

This means the rule will match events where the event type is classified under theDomain Account Lockedcategory.

2.Reporting IP IN Applications: Domain Controller

This means the rule is filtering for events where the reporting IP is classified under theDomain Controller applications group.

3.Logical Operator: AND

The filters are combined usingAND, meaning both conditions must be met for an event to match.

Since both conditions must be true, the rule is effectively filtering events where:

● Theevent typebelongs to theDomain Account Locked CMDB group

● Thereporting IPbelongs to theDomain Controller applications group

The phProvisionCollector command is used to register a collector to the supervisor in FortiSIEM. The correct syntax requires:

● User → The admin username for authentication.

● Password → The password for authentication.

● Super IP → The IP address of the supervisor, which manages the collector.

● Organization → The organization to which the collector belongs.

● Worker Name → The name of the worker node responsible for handling events from this collector.

InFortiSIEM baselining, anhourly bucketis used to maintainhourly-specific statistical baselines. This helps detect anomalies by comparing current activity against historical norms foreach hour of the day, separately forweekdays and weekends.

The system maintainshourly profiles, ensuring that anomalies are detected based on similar timeframes. This approach prevents false positives due to natural variations in network activity across different times of the day and different days of the week.