As part of your analysis, you discover that an incident is a false positive. You change the incident status to Closed: False Positive. Which statement about your update is true?

The correct answer is A. The audit history log will be updated. When an incident is closed as a false positive in FortiAnalyzer, it is not deleted or renumbered. Instead, the closure action is recorded in the audit history, preserving a traceable record of analyst actions for accountability and compliance.

SOC Features (Playbooks, Incident Response)

Question

Options

AThe audit history log will be updated.
BThe corresponding event will be marked as mitigated.
CThe incident will be deleted.
DThe incident number will be changed

How the community answered

(22 responses)

A
77% (17)
B
5% (1)
C
14% (3)
D
5% (1)

Explanation

When an incident is closed as a false positive in FortiAnalyzer, it is not deleted or renumbered. Instead, the closure action is recorded in the audit history, preserving a traceable record of analyst actions for accountability and compliance.

Topics

#incident lifecycle#false positive#audit history#incident status

Community Discussion

No community discussion yet for this question.

Full FCP_FAZ_AN-7.4 Practice