Utilize Rule Subpatterns, Aggregation, and Group By NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is used within a FortiSIEM rule subpattern to combine multiple event conditions?

   • AThe group by clause
   • BLogical operators such as AND, OR, and NOT
   • CThe aggregation function
   • DThe notification action
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a FortiSIEM rule, which clause would you use to count failed login events per user?

   • Afilter by user
   • Bgroup by user
   • Caggregate by user
   • Dorder by user
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which aggregation function would you apply to a subpattern to calculate the average value of a numeric event attribute over a time window?

   • Acount
   • Bsum
   • Cmax
   • Davg
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In FortiSIEM, what is the primary purpose of a rule subpattern?

   • ATo define which users have permission to view the rule
   • BTo specify the output format of the rule's notification message
   • CTo define a sequence of event conditions that must be matched for the rule to trigger
   • DTo schedule when the rule will run and how often
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   A FortiSIEM analyst is building a rule to detect a security pattern. The rule uses a subpattern to match failed login events, and another subpattern to match successful login events from the same source IP address. The analyst wants to count the number of failed attempts that occur before a successful login, and then trigger an alert only if that count exceeds a threshold. Which FortiSIEM rule feature is essential to ensure that the count of failed attempts is tracked separately for each source IP address?

   • AFilter condition
   • BSubpattern correlation
   • CGroup by Source IP
   • DAggregation window
   Reveal Solution Discussion Select an answer first