Where can you define automated remediation on FortiSIEM?

Question

Options

• AIntegration policy
• BNotification policy
• CAuthentication policy
• DRemediation policy

• A
  6% (2)
• B
  88% (30)
• C
  3% (1)
• D
  3% (1)

Explanation

In FortiSIEM, Notification Policies serve a dual purpose: they define both how administrators are alerted when incidents fire and how automated remediation actions are triggered. Within a notification policy, you can attach remediation scripts or connector actions that execute automatically when matching incident conditions are met, making it the single configuration point for the full incident response workflow.

Why the distractors are wrong:

• A. Integration policy - Governs how FortiSIEM connects and communicates with external systems/devices, not response actions.
• C. Authentication policy - Controls user login and access rules; unrelated to incident remediation.
• D. Remediation policy - Sounds like the obvious choice, but this policy type does not exist in FortiSIEM's interface - it's a deliberate trap.

Memory tip: Think of "Notification" in FortiSIEM as "Notify and Act" - it covers both the alert and the automated fix. If you expect a dedicated "Remediation Policy," remember that FortiSIEM bundles remediation into notifications rather than separating it.

No community discussion yet for this question.