QUESTION 10
Refer to the exhibit.

A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.
Based on the selected filters shown in the exhibit, why are there no search results?

QUESTION 11
Which command displays the Linux agent status?

QUESTION 12
Where do you configure rule notifications and automated remediation on FortiSIEM?

QUESTION 13
In the advanced analytical rules engine in FortiSIEM, multiple subpatterms can be referenced using which three operation?(Choose three.)

QUESTION 14
Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

QUESTION 15
If the reported packet loss is between 50% and 98%. which status is assigned to the device in the Availability column of summary dashboard?

QUESTION 16
Consider the storage of anomaly baseline date that is calculated for different parameters. Which database is used for storing this data?

QUESTION 17
Refer to the exhibit.

An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.
Which is the correct expression?

QUESTION 18
In the rules engine, which condition instructs FortiSIEM to summarize and count the matching evaluated data?

QUESTION 19
Device discovery information is stored in which database?

QUESTION 20
An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.
Which is the correct expression?

QUESTION 21
How was the FortiGate device discovered by FortiSIEM?

QUESTION 22
Refer to the exhibit.

If events are grouped by Reporting IP, Event Type, and user attributes in FortiSIEM, how ,many results will be displayed?

QUESTION 23
Refer to the exhibit.

How was the FortiGate device discovered by FortiSIEM?

QUESTION 24
IF the reported packet loss is between 50% and 98%. which status is assigned to the device in the Availability column of summary dashboard?

QUESTION 25
An administrator wants to search for events received from Linux and Windows agents.
Which attribute should the administrator use in search filters, to view events received from agents only.

QUESTION 26
Refer to the exhibit.

An administrator is investigating a FortiSIEM license issue.
The procedure is for which offline licensing condition?

QUESTION 27
Refer to the exhibits.


Three events are collected over a 10-minute time period from two servers: Server A and Server B.
Based on thesettings tor the rule subpattern. how many incidents will the servers generate?

QUESTION 28
What does the Frequency field determine on a rule?