View all questions & answers for the NSE 6 - FortiSIEM 7.2 Analyst Exam Materials exam

NSE 6 - FortiSIEM 7.2 Analyst Exam Materials - Question #50 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibit. An analyst is trying to generate an incident with a title that includes the Source IP, Destination IP, User, and Destination Host Name. They are unable to add a Destination Host Name as an incident attribute. What must be changed to allow the analyst to select Destination Host Name as an attribute? (Choose one answer)

  • A. The Destination Host Name must be set as an aggregate item in a subpattern.
  • B. The Destination Host Name must be added as an Event type in the FortiSIEM.
  • C. The Destination Host Name must be selected as a Triggered Attribute.
  • D. The Destination IP Event Attribute must be removed.
Correct Answer: B

Brave-Dump Community Votes

Answer: B (1 vote) 50%
Answer: A (1 vote) 50%

Community Explanations & Comments (2)

Zaid Haitham 1 year ago
Selected: B
I think it is B
Brave-Dumps.com Admin 1 year ago
Thank you, Zaid, for being a part of brave-dumps community, please explain why B?
Zaid Haitham 1 year ago
i have tested in fortisiem. Triggered attribute has no effect on that
Anonymous User 8 months ago
Selected: A
In FortiSIEM’s Incident Generator when creating an incident rule and defining the Incident Title, only the attributes that are part of the subpattern , and defined as aggregate items can be used in the incident title or inserted as incident attributes.

https://help.fortinet.com/fsiem/6-1-2/Online-Help/HTML5_Help/Creating-rules.html