NSE7_SOC_AR-7.6 · Question #9
Refer to the Exhibit. An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious attachment event based on FortiSandbox analysis. The endpoint hosts…
The correct answer is D. Local connector. In FortiAnalyzer playbooks, the Get Events, Run Report, and Create Incident actions are all provided by the Local Connector. No external connector (e.g. FortiSandbox or EMS) is needed to retrieve the sandbox‑detected event, generate the report, or open the incident record.
Question
Refer to the Exhibit. An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious attachment event based on FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS integrated with FortiSandbox. All devices are logging to FortiAnalyzer. Which connector must the analyst use in this playbook?
Exhibit
Options
- AFortiSandbox connector
- BFortiClient EMS connector
- CFortiMail connector
- DLocal connector
How the community answered
(17 responses)- A6% (1)
- B12% (2)
- C6% (1)
- D76% (13)
Explanation
In FortiAnalyzer playbooks, the Get Events, Run Report, and Create Incident actions are all provided by the Local Connector. No external connector (e.g. FortiSandbox or EMS) is needed to retrieve the sandbox‑detected event, generate the report, or open the incident record.
Topics
Community Discussion
No community discussion yet for this question.