176 Certification Products • 3429 Comments • 2479 Questions
Which two statements about local logs on FortiAnalyzer are true?
Refer to the exhibit. What can you conclude from this output?
Refer to the exhibit. A FortiAnalyzer analyst is customizing a SQL query to use in a report. Which SQL query should the analyst run to get the expected results?
Refer to the exhibit. What is the analyst trying to create?
In your role as an analyst, you frequently search the log view using the same parameters. Instead of defining the same search filters repeatedly, what can you do to save time?
You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but so far, you have been unsuccessful. Which two tasks should you perform to investigate why you are having this issue?
After generating a report, you notice that the information you were expecting to see is not included in that report. However, you confirm that the logs are there. Which two actions must you perform?
How does FortiAnalyzer block indicators?
What are the two methods you can use to send notifications when an event is generated by an event handler?
You created a playbook on FortiAnalyzer that uses a FortiOS connector. When you configure FortiGate, which type of trigger must you use so that the actions in an automation stitch are available in the FortiOS connector?
Refer to the exhibit. An analyst is using FortiView to look at the top threats recorded by FortiAnalyzer in the last 2 hours. What can the analyst conclude from the exhibit?
As part of your analysis, you discover that an incident is a false positive. You change the incident status to Closed: False Positive. Which statement about your update is true?
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blocklisted IP addresses?
When working with datasets, which SQL query is in the correct order to query the database on FortiAnalyzer?
Refer to the exhibit. What can you conclude about the output?
Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all attempts to log in to the web interface generated by any user other than “admin”, and coming from Laptop1. Which filter will...
Which two statements about playbook execution are true?
What is the purpose of using data selectors when configuring event handlers?
Why must you wait for several minutes before you run a playbook that you just created?
What should you always do after erasing the FortiAnalyzer configuration on flash?