Fortinet Certified Professional Security Operations NSE7_SOC_AR-7.6 Book

Understanding the Issue :

The custom event handler for detecting SMTP reconnaissance activities is generating a large number of events.

This high volume of events is overwhelming the notification system, leading to potential alert fatigue and inefficiency in incident response.

Event Handler Configuration :

Event handlers are configured to trigger alerts based on specific criteria.

The frequency and volume of these alerts can be controlled by adjusting the trigger conditions.

Possible Solutions :

A. Increase the trigger count so that it identifies and reduces the count triggered by a particular group :

By increasing the trigger count, you ensure that the event handler only generates alerts after a higher threshold of activity is detected.

This reduces the number of events generated and helps prevent overwhelming the notification system.

Selected as it effectively manages the volume of generated events.

B. Disable the custom event handler because it is not working as expected :

Disabling the event handler is not a practical solution as it would completely stop monitoring for SMTP reconnaissance activities.

Not selected as it does not address the issue of fine-tuning the event generation.

C. Decrease the time range that the custom event handler covers during the attack :

Reducing the time range might help in some cases, but it could also lead to missing important activities if the attack spans a longer period.

Not selected as it could lead to underreporting of significant events.

D. Increase the log field value so that it looks for more unique field values when it creates the event :

Adjusting the log field value might refine the event criteria, but it does not directly control the volume of alerts.

Not selected as it is not the most effective way to manage event volume.

Implementation Steps :

Step 1 : Access the event handler configuration in FortiAnalyzer.

Step 2 : Locate the trigger count setting within the custom event handler for SMTP reconnaissance.

Step 3 : Increase the trigger count to a higher value that balances alert sensitivity and volume.

Step 4 : Save the configuration and monitor the event generation to ensure it aligns with expected levels.

Conclusion :

By increasing the trigger count, you can effectively reduce the number of events generated by the custom event handler, preventing the notification system from being overwhelmed.

Collector 2. Worker 3. Supervisor 4. Agent

The FortiSIEM 7.3 architecture is built upon a distributed multi-tenant model consisting of several distinct functional roles to ensure scalability and performance:

Supervisor: This is the primary management node in a FortiSIEM cluster. It hosts the Graphical User Interface (GUI), the Configuration Management Database (CMDB), and manages the overall system configurations, reporting, and dashboarding.

Worker: These nodes are responsible for the heavy lifting of data processing. They execute real-time event correlation against the rules engine, perform historical search queries, and handle the analytics workload to ensure the Supervisor node is not overwhelmed.

Collector: Collectors are typically deployed at remote sites or different network segments to offload log collection from the central cluster. They receive logs via Syslog, SNMP, or WMI, compress the data, and securely forward it to the Workers or Supervisor. They also perform performance monitoring of local devices.

Agent: These are lightweight software components installed directly on endpoints (Windows/Linux). Their primary role is to collect local endpoint logs, monitor file integrity (system changes), and track user activity that cannot be captured via traditional network-based logging.

Exact Extract: “Custom API Endpoint: Specify an arbitrary endpoint used to externally start a playbook. Uses a REST API POST action from another system. Supports token-based, basic, and no authentication.”

The correct answers are A and D. A Custom API Endpoint trigger allows an external system to start a FortiSOAR playbook through a defined arbitrary endpoint. It supports token-based authentication, basic authentication, or no authentication, depending on how you configure the trigger. C is wrong because the guide specifies REST API POST, not GET and PUT. B is not supported by the described trigger behavior; the endpoint is configured as a trigger for a playbook, not as a broadcast mechanism to trigger multiple playbooks simultaneously.

Technical Deep Dive: This trigger is useful when an external system cannot use a native FortiSOAR connector but can make an HTTP API call. Common use cases include webhook-style ingestion, third-party alert forwarding, and external workflow integration. Secure it properly; “no authentication” is possible but usually unacceptable in production unless protected by network controls.

Exact Extract: “Action: Click the edit icon to define the incident attributes and triggered attributes that this rule must generate. You must define at least one incident before you can save a rule.”

Exact Extract: “Triggered Attributes: Select the attributes from the triggering events that you want to include as columns in the Dashboard and Incidents interfaces for this event.”

The correct answer is A . The Reporting IP column is controlled by the rule’s Triggered Attributes configuration under the Define Action / Incident Action settings. If Reporting IP is selected there, FortiSIEM includes it as a displayed incident-related column. Since the topology has only one firewall, the Reporting IP value is repetitive and provides little analytical value, so you remove it by clearing Reporting IP from the Triggered Attributes list.

Option B is wrong because correlation/grouping logic is configured in the rule condition or subpattern, not used to hide columns. Option C is reckless and incorrect; Reporting IP is a normalized event attribute and should not be removed from raw logs or parser output just to change a display column. Option D is only a display-level idea and does not address the rule-generated triggered attributes that define which event attributes are exposed for the incident.

Technical Deep Dive: FortiSIEM separates rule detection logic from incident presentation metadata. The subpattern filter and aggregate decide whether an incident triggers. The Triggered Attributes decide which matching event fields analysts see as incident columns. In this case, you do not change parsing, event normalization, or correlation. You only tune the incident action output so analysts focus on useful fields such as Source IP, Destination IP, and Destination Port. FortiGate NP/CP acceleration is irrelevant because this is FortiSIEM event presentation logic, not firewall packet forwarding or ASIC offload behavior.