NSE5_FSM-6.3 Exam Dumps : Fortinet NSE 5 - FortiSIEM 6.3

 Process Monitoring in FortiSIEM: FortiSIEM can monitor critical processes on managed devices, such as an SMTP process on a Linux server.

 Event Generation: When a critical process stops, FortiSIEM generates an event to alert administrators.

 Event Types: Specific event types correspond to different monitored conditions. For a stopped process, the event typePH_DEV_MON_PROC_STOPis used.

 Reasoning: The namePH_DEV_MON_PROC_STOP(Device Monitoring Process Stop) is a generic event type used by FortiSIEM to indicate that any monitored process, including SMTP, has stopped.

 References: FortiSIEM 6.3 User Guide, Event Types section, explains the predefined event types and their usage in different monitoring scenarios.

 Incident Status in FortiSIEM: The status of an incident indicates its current state and helps administrators track and manage incidents effectively.

 Cleared Status: When an incident’s status is "Cleared," it means that a specific condition set to clear the incident has been satisfied.

Clear Condition: This is typically a predefined condition that indicates the issue causing the incident has been resolved or no longer exists.

 Automatic vs. Manual Clearance: While some incidents may be cleared automatically based on clear conditions, others might be manually cleared by an operator.

 References: FortiSIEM 6.3 User Guide, Incident Management section, detailing the various incident statuses and the conditions that lead to an incident being marked as "Cleared."

 Device Status in FortiSIEM: FortiSIEM assigns different statuses to devices based on their operational state and performance metrics.

 Packet Loss Impact: The reported packet loss percentage directly influences the status assigned to a device. Packet loss between 50% and 98% indicates significant network issues that affect the device's performance.

 Degraded Status: When packet loss is between 50% and 98%, FortiSIEM assigns a "Degraded" status to the device. This status indicates that the device is experiencing substantial packet loss, which impairs its performance but does not render it completely non-functional.

 Reasoning: The "Degraded" status helps administrators identify devices with serious performance issues that need attention but are not entirely down.

 References: FortiSIEM 6.3 User Guide, Device Availability and Status section, explains the criteria for assigning different statuses based on performance metrics such as packet loss.