A FortiSIEM administrator is seeing a large number of low-severity incidents generated from a single correlation rule that matches multiple related events from the same source within a short time window. The administrator wants to reduce the noise while still detecting the underlying pattern. What should the administrator do?

Manually merge the incidents in the console each time they appear.

Increase the aggregation window of the correlation rule so that related events are grouped into a single incident.

Create a tuning rule that suppresses incidents when the severity is low.

Disable the correlation rule entirely to stop all incidents from that pattern.

A FortiSIEM administrator notices that the same incident is being generated repeatedly for the same event pattern, even after the incident was resolved. The administrator wants to prevent duplicate incidents for the same event within a specific time frame. What should the administrator do?

Enable deduplication settings to suppress duplicate incidents within a defined time window.

Change the incident priority to 'Low' so it is less visible.

Disable the correlation rule that generates the incident.

Manually close each duplicate incident as it appears.

What is the function of a tuning rule in FortiSIEM?

To delete all historical incident data

To increase the priority of all incidents

To suppress or modify incident generation based on specific conditions

To automatically resolve all open incidents

A FortiSIEM administrator is managing a whitelist that suppresses incidents from a known benign source. However, the administrator is concerned that the whitelist may be too broad and could suppress legitimate incidents if the source is compromised. What should the administrator do to mitigate this risk?

Increase the incident priority for the whitelisted source.

Remove the whitelist entry and rely on tuning rules instead.

Disable the whitelist and manually review all incidents from that source.

Add a time limit to the whitelist entry so it expires after a certain period.

FortinetNSE 6 - FortiSIEM Analyst

Domain 4Objective 1

Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 4)

Part of the Incidents, Notifications, and Remediation domain, which makes up ~24% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

Questions 16–20

16application · medium
A FortiSIEM administrator is seeing a large number of low-severity incidents generated from a single correlation rule that matches multiple related events from the same source within a short time window. The administrator wants to reduce the noise while still detecting the underlying pattern. What should the administrator do?
Select an answer first
17application · medium
A FortiSIEM administrator notices that the same incident is being generated repeatedly for the same event pattern, even after the incident was resolved. The administrator wants to prevent duplicate incidents for the same event within a specific time frame. What should the administrator do?
Select an answer first
18foundation · easy
What is the function of a tuning rule in FortiSIEM?
Select an answer first
19expert · hard
A FortiSIEM administrator is managing a whitelist that suppresses incidents from a known benign source. However, the administrator is concerned that the whitelist may be too broad and could suppress legitimate incidents if the source is compromised. What should the administrator do to mitigate this risk?
Select an answer first
20application · medium
An analyst is working on an incident and has identified the root cause. The analyst has applied a temporary workaround and wants to indicate that the incident is no longer actively being worked on, but the final fix has not yet been implemented. Which status should the analyst set the incident to?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.

Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

A FortiSIEM administrator notices that the same incident is being generated repeatedly for the same event pattern, even after the incident was resolved. The administrator wants to prevent duplicate incidents for the same event within a specific time frame. What should the administrator do?

What is the function of a tuning rule in FortiSIEM?

An analyst is working on an incident and has identified the root cause. The analyst has applied a temporary workaround and wants to indicate that the incident is no longer actively being worked on, but the final fix has not yet been implemented. Which status should the analyst set the incident to?

Keep studying — Incidents, Notifications, and Remediation