How does FortiAnalyzer block indicators?

The correct answer is C. It uses a FortiManager connector to send the block list. FortiAnalyzer does not block indicators directly. Instead, it sends the IOC block list to FortiManager, which then updates the FortiGate policy objects or external block lists. The FortiManager connector is therefore the mechanism used to push blocking actions to FortiGate.

Alerting and Incident Response

Question

Options

AIt uses a webhook to allow FortiGate to send the block list.
BIt uses a FortiClient EMS connector to send the block list.
CIt uses a FortiManager connector to send the block list.
DIt uses an automation script to update FortiGate with the block list.

How the community answered

(46 responses)

A
2% (1)
B
2% (1)
C
89% (41)
D
7% (3)

Explanation

FortiAnalyzer does not block indicators directly. Instead, it sends the IOC block list to FortiManager, which then updates the FortiGate policy objects or external block lists. The FortiManager connector is therefore the mechanism used to push blocking actions to FortiGate.

Topics

#indicator blocking#FortiManager connector#block list#FortiAnalyzer

Community Discussion

No community discussion yet for this question.

Full FCP_FAZ_AN-7.6 Practice