Fortinet NSE 6 - FortiSIEM 7.4 Analyst (NSE6_FSM_AN-7.4)

FortiSIEM's UEBA models require rich, granular data to detect anomalous user and entity behavior. Dedicated endpoint agents are specifically designed to collect this comprehensive telemetry. While both FortiSIEM Linux and Windows agents collect valuable data for UEBA, the option 'Windows UEBA agent' specifically implies an agent optimized for generating the most comprehensive UEBA-relevant information from Windows environments, which are typically central to user activity.

When multiple rules are selected simultaneously in FortiSIEM, administrators can perform various bulk actions. These include activating or deactivating the selected rules to control their enforcement status, and changing their severity level. Viewing or editing typically applies to individual rules, not a group simultaneously, making option A the most accurate and comprehensive choice for multiple rule selection actions.

✅ Option B (Correct)

Reasoning: In FortiSIEM, the event type is typically derived from the most prominent and descriptive identifier at the beginning of the raw log message. The string 'PH_DEV_MON_SYS_UPTIME' enclosed in brackets serves as the primary identifier for this specific device monitoring event, which the parser will map to the event type attribute.

❌ Why the other choices are incorrect:

• Option A is incorrect: 'sysUpTime' is an attribute within the event, representing the system uptime value (4353), not the overall event type.
• Option C is incorrect: 'phLogDetail' is an attribute name that appears empty in this specific event, and it describes a detail field, not the main event type.
• Option D is incorrect: 'PHL_INFO' is the value assigned to the 'eventSeverity' attribute, indicating the severity level of the event, not its type.

The standard FortiSIEM method for evaluating rules over a specific, longer historical period, rather than in real-time streaming mode, is to configure the rule as 'Scheduled'. This setting, found under the rule's 'General' tab, allows administrators to define the frequency (e.g., every 8 hours) and the historical time window for each evaluation run. This is ideal for scenarios requiring periodic batch processing of events.

✅ Option A (Correct)

Reasoning: CMDB (Configuration Management Database) queries can be effectively used as subqueries. They provide contextual information about assets, such as criticality, location, or ownership, which can then be used to filter or enrich the results of a main analytics query.

✅ Option C (Correct)

Reasoning: Event queries are fundamental to SIEM platforms. A subquery can analyze a subset of events (e.g., all failed logins from a specific IP) and return relevant fields (like IP addresses or usernames) that the main query then uses for further correlation or analysis.

❌ Why the other choices are incorrect:

• Option B is incorrect: While FortiSIEM integrates with LDAP for authentication and user information, a direct 'LDAP query' is not a standard lookup type for defining subqueries within the nested analytics query engine for data enrichment or filtering in the same manner as CMDB or Event queries.
• Option D is incorrect: API queries are used for external integration and automation, but they are not a native 'lookup type' that can be referenced as a subquery within FortiSIEM's internal nested analytics query language for real-time data processing.

• Option A is incorrect: 'IncidentsMost Voted' refers to incident management, not a category directly mapped for displaying ATT&CK detection coverage.
• Option B is incorrect: 'CMDB Entries' relate to asset management and configuration, not MITRE ATT&CK detection mapping.
• Option E is incorrect: 'Procedures' are operational guidelines, not categories mapped to FortiSIEM's ATT&CK coverage tables.

When grouping events by "Reporting IP", "Event Type", and "User" attributes, FortiSIEM consolidates rows that share identical values across all three fields. From the exhibit, we identify three distinct combinations:

• (10.1.1.1, Logon, Mike)
• (10.1.1.1, Logon, Bob)
• (10.1.1.1, Logon, Alice)