FCSS_ADA_AR-6.7 · Question #15
FortiSIEM provides all rules with the ability to automatically change an active incident status to auto- cleared, based on an extra set of defined criteria. Why would you configure FortiSIEM to…
The correct answer is A. Because availability or performance-related problems may trigger a threshold temporarily. In FortiSIEM, some incidents may be triggered due to temporary threshold breaches, especially in availability or performance-related monitoring. These temporary anomalies do not necessarily indicate a persistent issue or security threat. By automatically clearing such…
Question
FortiSIEM provides all rules with the ability to automatically change an active incident status to auto- cleared, based on an extra set of defined criteria. Why would you configure FortiSIEM to automatically change an active incident status to auto- cleared?
Options
- ABecause availability or performance-related problems may trigger a threshold temporarily.
- BBecause too many active incidents can spike the resource usaqe on FortiSIEM.
- CBecause you need a way to reduce a backlog of incident responses.
- DBecause some security-related incidents occur on a temporary basis.
How the community answered
(34 responses)- A88% (30)
- B3% (1)
- C6% (2)
- D3% (1)
Explanation
In FortiSIEM, some incidents may be triggered due to temporary threshold breaches, especially in availability or performance-related monitoring. These temporary anomalies do not necessarily indicate a persistent issue or security threat. By automatically clearing such incidents, FortiSIEM prevents unnecessary manual intervention and reduces noise in incident management.
Topics
Community Discussion
No community discussion yet for this question.