NSE5_FSM-6.3 Exam Dumps : Fortinet NSE 5 - FortiSIEM 6.3

 Syslog Configuration in FortiSIEM: For FortiSIEM to receive syslog messages from network devices, those devices need to be properly configured to send syslog data to FortiSIEM.

 Manual Configuration Requirement: FortiSIEM does not automatically configure network devices to send syslog messages. Instead, this configuration must be performed manually by the network administrator.

 Process Overview: The network administrator must access each device and set up the syslog parameters to direct log data to the FortiSIEM collector's IP address.

 Discovery Process: While FortiSIEM can discover network devices using SNMP, WMI, and other protocols, the configuration of syslog on these devices is beyond its scope and requires manual intervention.

 References: FortiSIEM 6.3 User Guide, Device Configuration and Syslog Integration sections, which explain the requirements and steps for setting up syslog forwarding on network devices.

 Event Type Population: In FortiSIEM, the Event Type field is populated based on specific identifiers within the raw message or event log.

 Raw Message Analysis: The exhibit shows a raw message with various components, includingPH_DEV_MON_SYS_DISK_UTIL,PHL_INFO,phPerfJob, anddiskUtil.

 Primary Event Identifier: ThePH_DEV_MON_SYS_DISK_UTILat the beginning of the raw message is the primary identifier for the event type. It categorizes the type of event, in this case, a system disk utilization monitoring event.

 Event Type Field: FortiSIEM uses this primary identifier to populate the Event Type field, providing a clear categorization of the event.

 References: FortiSIEM 6.3 User Guide, Event Processing and Event Types section, details how event types are identified and populated in the system.