NSE5_FSM-6.3 · Question #21
An administrator wants to search for events received from Linux and Windows agents. Which attribute should the administrator use in search filters, to view events received from agents only.
The correct answer is D. External Event Receive Agents. Search Filters in FortiSIEM: When searching for specific events, administrators can use various attributes to filter the results. Attribute for Agent Events: To view events received specifically from Linux and Windows agents, the attribute External Event Receive Agents should…
Question
An administrator wants to search for events received from Linux and Windows agents. Which attribute should the administrator use in search filters, to view events received from agents only.
Options
- AExternal Event Receive Protocol
- BEvent Received Proto Agents
- CExternal Event Receive Raw Logs
- DExternal Event Receive Agents
How the community answered
(14 responses)- B14% (2)
- C7% (1)
- D79% (11)
Explanation
Search Filters in FortiSIEM: When searching for specific events, administrators can use various attributes to filter the results. Attribute for Agent Events: To view events received specifically from Linux and Windows agents, the attribute External Event Receive Agents should be used. Function: This attribute filters events that are received from agents, distinguishing them from events received through other protocols or sources. Search Efficiency: Using this attribute helps the administrator focus on events collected by FortiSIEM agents, making the search results more relevant and targeted.
Topics
Community Discussion
No community discussion yet for this question.