FCSS_ADA_AR-6.7 · Question #5
Refer to the exhibit. This is an example of a baseline profile that is configured in the backend of FortiSIEM. Which two Group By attributes are configured for this profile? (Choose two.)
The correct answer is B. Reporting Device C. Reporting IP. From the provided XML configuration, we need to focus on the <GroupByAttr> section, which defines the attributes used for grouping. In the SelectClause, the following attributes are listed: reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr)…
Question
Refer to the exhibit. This is an example of a baseline profile that is configured in the backend of FortiSIEM. Which two Group By attributes are configured for this profile? (Choose two.)
Exhibit
Options
- ALogon Failure
- BReporting Device
- CReporting IP
- DDistinct User
How the community answered
(42 responses)- A5% (2)
- B83% (35)
- D12% (5)
Explanation
From the provided XML configuration, we need to focus on the <GroupByAttr> section, which defines the attributes used for grouping. In the SelectClause, the following attributes are listed: reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr) reptDevName represents the reporting device. reptDevAddr represents the reporting IP. COUNT(DISTINCT user) tracks unique users. COUNT(DISTINCT srcIpAddr) tracks distinct source IPs. In the GroupByAttr section: <GroupByAttr>reptDevName, reptDevAddr</GroupByAttr> This confirms that the grouping is performed by Reporting Device (reptDevName) and Reporting IP (reptDevAddr).
Topics
Community Discussion
No community discussion yet for this question.