NSE6_FSM_AN-7.4 Exam Dumps : Fortinet NSE 6 - FortiSIEM 7.4 Analyst

To detect three failed login attempts within three minutes, you must set the aggregate count to 3 in the subpattern and the time window to 180 seconds in the rule condition. This ensures the rule triggers only if three or more failed logins occur in that timeframe.

The correct answer is A because three minutes equals 180 seconds, and the aggregate threshold must be set to three matching events. The FortiSIEM Study Guide explains that rule conditions specify event attributes and thresholds that trigger the rule and create an incident. It further states that the time window defines the period within which the subpattern must match for the rule condition to be satisfied. The Study Guide’s single-subpattern rule example shows the same principle: the condition has a configured time window, and the Aggregate section uses a function such as COUNT(Matched Events) to require a minimum number of matching events. In this question, the analyst wants the rule to trigger when three failed login attempts happen within three minutes . Therefore, the rule condition time window must be 180 seconds , and the aggregate count must be 3 . A 90-second window would detect only events inside one and a half minutes, not the required three minutes. An aggregate count of 2 would trigger too early because the requirement is three failed attempts.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.

The correct answer is A because CMDB objects are referenced from the Value field after selecting the appropriate event attribute and operator. The FortiSIEM Study Guide gives a structured search example that references the CMDB. In that example, the attribute is Reporting IP, the operator is IN, and the value is selected from CMDB groups such as Devices: Windows and Networks: Inside Net. The guide explains that to show events reported by Windows servers within a specific network, you set the attribute and operator first, then browse the CMDB and select the relevant CMDB group value. This confirms the workflow: the CMDB reference is chosen as the value of the condition, not as the attribute itself. Option B is incorrect because the CMDB tab is not used to launch the analytics search this way. Option C is not a valid workflow. Option D is wrong because the attribute is selected from event or CMDB attribute lists, while the CMDB object or group is selected in the value field.