FORTINETFortinet NSE 6 - FortiSIEM Analyst
The Fortinet NSE 6 - FortiSIEM Analyst certification validates your ability to search, enrich, and analyze security events using FortiSIEM. Designed for security professionals who detect, analyze, and remediate incidents, this credential proves your applied knowledge of FortiSIEM analytics, including operational scenarios, incident analysis, ZTNA integration, and troubleshooting. Earning it demonstrates hands-on expertise in one of the industry's leading SIEM platforms.
268 practice questions · Updated 2026-07-30
NSE6-FORTISIEM-ANALYST Curriculum
Every domain, objective, and concept the NSE6-FORTISIEM-ANALYST exam measures.
- Search result construction
- Event queries
- Group by operations
- Data aggregation functions
- CMDB query basics
- CMDB query filters
- CMDB query joins
- CMDB query output formatting
- Lookup table query basics
- Lookup table query filters
- Lookup table query joins
- Lookup table query output formatting
- Nested query construction
- Communication control policy overview
- Policy configuration steps
- Communication rules definition
- Policy assignment and deployment
- Policy monitoring and adjustment
- Security policy configuration
- Playbook configuration basics
- Creating a playbook
- Configuring playbook triggers
- Adding playbook actions
- Managing playbook execution flow
- Enabling and disabling playbooks
- Testing and validating playbooks
- FCS overview
- FCS integration
- Rule component types
- Component roles in rule logic
- Component configuration options
- Subpattern construction
- Aggregation in rules
- Group by in rules
- Combining subpatterns with aggregation and group by
- Analytics rule configuration
- Incident lifecycle management
- Incident tuning rules
- Incident aggregation and correlation
- Incident prioritization and assignment
- Incident status and workflow management
- Incident deduplication and grouping
- Incident suppression and whitelisting
- Incident review and feedback loop
- Notification policy basics
- Creating notification policies
- Configuring notification triggers
- Setting notification actions
- Defining notification recipients
- Testing notification policies
- Managing notification policies
- Remediation configuration
- ML configuration overview
- Accessing ML configuration settings
- Enabling and disabling ML features
- Setting ML model parameters
- Managing ML training data
- Scheduling ML model updates
- Monitoring ML configuration status
- Troubleshooting ML configuration issues
- UEBA integration overview
- Configuring UEBA data sources
- Using UEBA data in rules
- Visualizing UEBA data in dashboards
- ZTNA integration overview
- ZTNA configuration in FortiSIEM
- ZTNA event collection and parsing
- ZTNA monitoring and alerting
- ZTNA incident investigation
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for NSE6-FORTISIEM-ANALYST, so none is invented.