Refer to the exhibit. Consider the five account locked events received by FortiSIEM from domain controllers within the last 10 minutes (ten minutes is the evaluation window for the subpattern…

The correct answer is C. 2. The rule groups events by Reporting IP, Reporting Device, and User. Let's analyze the five Events Received: 1. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: John 2. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: Craig 3. Reporting IP: 1.1.1.2, Reporting…

Advanced FortiSIEM Analytics

Question

Refer to the exhibit. Consider the five account locked events received by FortiSIEM from domain controllers within the last 10 minutes (ten minutes is the evaluation window for the subpattern DomainAcctLockout):

If you look for one or more matching events and groupings by the same reporting IP address, reporting device, and user, how many incidents are created?

Exhibits

Options

How the community answered

(42 responses)

A
10% (4)
B
24% (10)
C
60% (25)
D
7% (3)

Explanation

The rule groups events by Reporting IP, Reporting Device, and User. Let's analyze the five Events Received: 1. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: John 2. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: Craig 3. Reporting IP: 1.1.1.2, Reporting Device: Server109, User: Mary 4. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: Craig (Duplicate of #2) 5. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: John (Duplicate of #1) Grouping Based on: Reporting Device Count unique groups: 1. (1.1.1.1, Server101, John) 2 occurrences (counted as one group) 2. (1.1.1.1, Server101, Craig) 2 occurrences (counted as one group) 3. (1.1.1.2, Server109, Mary) 1 occurrence (counted as one group) Since we need at least one matching event (count >= 1) per group, incidents are created for each unique group. Total unique groups (incidents created) = 2 John on Server101 (1.1.1.1) Craig on Server101 (1.1.1.1)

Topics

#incident creation#subpattern evaluation#Group By correlation#event grouping

Community Discussion

No community discussion yet for this question.

Full FCSS_ADA_AR-6.7 Practice