Which two statements are true regarding the outbreak detection service? (Choose two.)

The FortiGuard Outbreak Detection Service is a subscription-based feature for FortiAnalyzer that enhances threat detection. It requires an additional license to operate. The service functions by automatically receiving threat intelligence packages from FortiGuard Labs when a new threat is discovered. These packages contain updated components, such as event handlers and reports, which FortiAnalyzer then uses to scan its logs for evidence of the newly identified threat. This mechanism allows for the retroactive discovery of threats that may have gone unnoticed before they were identified by FortiGuard.

A: Alerts are generated and displayed on the FortiAnalyzer dashboard and in FortiView. While email notifications can be configured for alerts, it is not the primary or guaranteed delivery method for the service itself.

B: The Outbreak Detection summary widget is available on the root ADOM's dashboard, but the specific threat alerts are visible in the FortiView of the ADOM where the threat was actually detected.

1. FortiAnalyzer 7.4.2 Administration Guide

Page 310

Section: "Outbreak Detection"

"The FortiGuard Outbreak Detection Service is a subscription-based service." (Supports Answer C)

"When a new threat is discovered

FortiGuard Labs creates a package that includes an updated event handler and report. The package is then pushed to FortiAnalyzer devices that have the Outbreak Detection Service enabled. The package is automatically downloaded and used to scan the logs for the new threat." (Supports Answer D)

2. FortiAnalyzer 7.4.2 Administration Guide

Page 311

Section: "Outbreak Alert"

"When a threat is detected

an alert is generated and displayed on the Dashboard and FortiView > Threats pages." (Contradicts A as the primary method)

"The Outbreak Detection summary widget is available on the dashboard for the root ADOM." (Contradicts B

as this refers to the summary widget

not all alerts

which appear in relevant ADOMs' FortiView).