Refer to the exhibit. The window for this rule is 30 minutes. What is this rule tracking?

The correct answer is C. A sudden 150% increase in WMI response times over a 30-minute time window. The rule is tracking a sudden increase in WMI response times over a 30-minute window. The key detail here is the increase factor. The term 1.50 times increase means the new value is 150% of the previous baseline. A 1.50x increase corresponds to a 150% increase, since the new…

Advanced FortiSIEM Analytics

Question

Exhibit

Options

AA sudden 50% increase in WMI response times over a 30-minute time window
BA sudden 1.50 times increase in WMI response times over a 30-minute time window
CA sudden 150% increase in WMI response times over a 30-minute time window
DA sudden 75% increase in WMI response times over a 30-minute time window

How the community answered

(36 responses)

A
6% (2)
B
11% (4)
C
81% (29)
D
3% (1)

Explanation

The rule is tracking a sudden increase in WMI response times over a 30-minute window. The key detail here is the increase factor. The term 1.50 times increase means the new value is 150% of the previous baseline. A 1.50x increase corresponds to a 150% increase, since the new value is original + 150% of original.

Topics

#baseline deviation#WMI response time#anomaly detection#rule thresholds

Community Discussion

No community discussion yet for this question.

Full FCSS_ADA_AR-6.7 Practice