QUESTION 49
What must match when referencing an inner query from an outer query?

QUESTION 50
Which two settings must you configure to allow FortiSIEM to apply tags to devices in FortiClient EMS?
(Choose two.)

QUESTION 51
In an automation policy, which two methods can you use for notifications when an incident is triggered? (Choose two.)

QUESTION 52
In FortiSIEM, which database stores discovery information?

QUESTION 53
How does FortiSIEM update the incident details if the same rule triggers repeatedly?

QUESTION 54
Refer to the exhibit.

An analyst is troubleshooting the rule shown in the exhibit. It is not generating any incidents, but the filter parameters are generating events on the Analytics tab.
What is wrong with the rule conditions?

QUESTION 55
Refer to the exhibit.

If you group the events by User , Source IP , and Count attributes, how many results will FortiSIEM display?

QUESTION 56
Refer to the exhibit. What will FortiSIEM display if you apply the Group By and Display Fields configuration to a list of allowed firewall connections?

QUESTION 57
Refer to the exhibit.

What is the Group: VPN Gateway value a reference to? (Choose one answer)

QUESTION 58
Refer to the exhibit.

An analyst wants to perform a KMeans machine learning (ML) job on this data.
How many N clusters would be a good fit for the data?

QUESTION 59
When configuring machine learning (ML), in which step can you modify how the model fits the training data set?

QUESTION 60
Refer to the exhibit.

An analyst is trying to generate an incident with a title that includes the Source IP, Destination IP, User, and Destination Host Name. They are unable to add Destination Host Name as an incident attribute.
What must be changed to allow the analyst to select Destination Host Name as an attribute?

QUESTION 61
Which data collection method generates the most comprehensive information for FortiSIEM user entity and behavior analytics (UEBA) models?

QUESTION 62
Refer to the exhibit. What will happen when a device being analyzed by the machine learning (ML) configuration shown in the exhibit has a consistently high memory use?

QUESTION 63
An analyst wants to create a rule from a new analytic search they just performed. Which method is the most efficient way for you to create the rule?

QUESTION 64
When selecting multiple rules at once on FortiSIEM, which actions can you perform?

QUESTION 65
Refer to the exhibit.

An incorrect configuration is shown.
Which setting must you change to successfully apply this configuration to FortiSIEM?

QUESTION 66
Refer to the exhibit.

If a rule containing the automation policy shown in the exhibit triggers, what will happen?

QUESTION 67
Where must you define and assign a custom python script as a remediation action?

QUESTION 68
Refer to the exhibit.

What is the Group: VPN Gateway value a reference to?