What happens to UEBA events when a user is off-net?

The correct answer is A. The agent will cache events locally if it cannot upload them to a FortiSIEM collector. When a User and Entity Behavior Analytics (UEBA) agent is off-net, meaning it is disconnected from the network and cannot reach the FortiSIEM collector, it temporarily stores (caches) events locally until it can re-establish a connection. This caching mechanism prevents data…

FortiSIEM Architecture and Deployment

Question

Options

AThe agent will cache events locally if it cannot upload them to a FortiSIEM collector
BThe agent will drop the events if it cannot upload them to a FortiSIEM collector
CThe agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector
DThe agent will upload the events the events to the Supervisor if it cannot upload them to a

How the community answered

(33 responses)

A
94% (31)
B
3% (1)
D
3% (1)

Explanation

When a User and Entity Behavior Analytics (UEBA) agent is off-net, meaning it is disconnected from the network and cannot reach the FortiSIEM collector, it temporarily stores (caches) events locally until it can re-establish a connection. This caching mechanism prevents data loss by ensuring events are retained even when the agent is offline. Once the connection to the FortiSIEM collector is restored, the agent uploads the cached events. This ensures continuity in user behavior monitoring, even when users are disconnected.

Topics

#UEBA agent#offline caching#event collection#off-net behavior

Community Discussion

No community discussion yet for this question.

Full FCSS_ADA_AR-6.7 Practice