Fortinet
NSE7_OTS-7.2 · Question #3
An OT administrator is defining an incident notification policy using FortiSIEM and would like to configure the system with a notification policy. If an incident occurs, the administrator would like…
The correct answer is B. Create a notification policy and define a script/remediation on FortiSIEM. https://fusecommunity.fortinet.com/blogs/silviu/2022/04/12/fortisiempublishingscript
Troubleshooting FortiAnalyzer
Question
An OT administrator is defining an incident notification policy using FortiSIEM and would like to configure the system with a notification policy. If an incident occurs, the administrator would like to be able to intervene and block an IP address or disable a user in Active Directory from FortiSIEM. Which step must the administrator take to achieve this task?
Options
- AConfigure a fabric connector with a notification policy on FortiSIEM to connect with FortiGate.
- BCreate a notification policy and define a script/remediation on FortiSIEM.
- CDefine a script/remediation on FortiManager and enable a notification rule on FortiSIEM.
- DDeploy a mitigation script on Active Directory and create a notification policy on FortiSIEM.
How the community answered
(47 responses)- A2% (1)
- B77% (36)
- C15% (7)
- D6% (3)
Explanation
https://fusecommunity.fortinet.com/blogs/silviu/2022/04/12/fortisiempublishingscript
Topics
#FortiSIEM#SOAR#notification policy#remediation script
Community Discussion
No community discussion yet for this question.