Fortinet
NSE7_OTS-7.2 · Question #72
Refer to the exhibit.A new operational technology rule is being created to monitor Modbus protocol traffic on FortiSIEM. Which action will ensure all Modbus messages on the network match the rule?
The correct answer is B. Add a new condition to filter Modbus traffic based on the Source TCP/UDP port. https://community.fortinet.com/t5/FortiSIEM/Technical-Note-How-do-I-create-and-or-customize- rules-and-alerts/ta-p/196013
FortiAnalyzer for OT
Question
Refer to the exhibit.A new operational technology rule is being created to monitor Modbus protocol traffic on FortiSIEM. Which action will ensure all Modbus messages on the network match the rule?
Exhibit
Options
- ASet the Aggregate attribute value to equal to or greater than zero.
- BAdd a new condition to filter Modbus traffic based on the Source TCP/UDP port.
- CThis rule is valid and requires no additional changes.
- DRemove attributes in the Group By section that are not configured in the Filter section.
How the community answered
(46 responses)- A4% (2)
- B80% (37)
- C13% (6)
- D2% (1)
Explanation
https://community.fortinet.com/t5/FortiSIEM/Technical-Note-How-do-I-create-and-or-customize- rules-and-alerts/ta-p/196013
Topics
#FortiSIEM rule creation#Modbus protocol#OT traffic monitoring#rule conditions
Community Discussion
No community discussion yet for this question.