View all questions & answers for the NSE 6 - FortiSIEM 7.2 Analyst Exam Materials exam

NSE 6 - FortiSIEM 7.2 Analyst Exam Materials - Question #11 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibit. An analyst is troubleshooting the rule shown in the exhibit. It is not generating any incidents, but the filter parameters are generating events on the Analytics tab. What is wrong with the rule conditions? (Choose one answer)

  • A. The Aggregate attribute is too restrictive.
  • B. The Destination Host Name value is not fully qualified.
  • C. The Group By attributes restricts which events are counted.
  • D. The Event Type refers to a CMDB lookup and should be an Event lookup.
Correct Answer: C

Brave-Dump Community Votes

Answer: A (1 vote) 50%
Answer: C (1 vote) 50%

Community Explanations & Comments (2)

mahmoud mostafa 1 year ago
Selected: A
Group by is some how like the filter.
just enhance how to show the result.
while the real restrictive condition is the aggregation.
if the event happens more than 3 times show me ,, else i am not interested
kair ahmid 1 year ago
Selected: C
I think is C
By grouping on Destination IP and User, the rule only counts events that share the same pair of values. Even though the filters match events in Analytics, they’re split across different groups, so COUNT(Source IP) >= 2 is never reached within a single group, and no incidents are generated.