NSE 6 - FortiSIEM 7.4 Analyst Exam Materials - Question #46 Discussion

You want to create a rule with multiple subpatterns but trigger an incident only if three different subpatterns are matched over a 24-hour period. Where must you define the time period that the rule uses to evaluate all the subpatterns? (Choose one answer)

• A. Define the time window in each individual subpattern.
• B. Define the time window under the General tab of the rule.
• C. Define the time window under the Define Condition tab of the rule.
• D. Define the time window in the Define Action section of the rule.

Brave-Dump Community Votes