NSE5_FSM-6-3 Practice Questions

 Device Discovery in FortiSIEM: Device discovery is the process by which FortiSIEM identifies and

adds devices to its management scope.

 Role of Collectors: Collectors are responsible for gathering data from network devices, including

discovering new devices in the network.

Functionality: Collectors use protocols such as SNMP, WMI, and others to discover devices and

gather their details.

 Capability: While agents (Windows and Linux) primarily gather data from their host systems, the

collectors actively discover devices across the network.

 Reference: FortiSIEM 6.3 User Guide, Device Discovery section, which details the role of collectors

in discovering network devices.

 Feature Overview: FortiSIEM provides several tools for querying and reporting on device

information within an environment.

 Inventory Tab: The Inventory tab is specifically designed to display detailed information about

devices, including their firmware versions.

 Query Functionality: Within the Inventory tab, you can run queries to filter and display devices

based on specific attributes, such as the firmware version for FortiGate devices.

 Report Generation: By running a query in the Inventory tab, you can produce a report that lists the

FortiGate devices and their corresponding firmware versions.

 Reference: FortiSIEM 6.3 User Guide, Inventory Management section, explains how to use the

Inventory tab to query and report on device attributes.

 Search Filters in FortiSIEM: When searching for events, the correct use of filters and logical

operators is crucial to obtain accurate results.

 Issue Analysis:

Selected Filters: The exhibit shows filters for two different Reporting IP addresses.

Logical Operators: The use of "AND" between the two Reporting IP addresses implies that an event

must match both IP addresses simultaneously, which is not possible for a single event.

 Correct Usage: To search for events from either of the two IP addresses, parentheses should be

used to group conditions logically.

Corrected Filter: (Reporting IP = 192.168.1.1 OR Reporting IP = 172.16.10.3) would return events

from either IP address.

 Reference: FortiSIEM 6.3 User Guide, Search and Filters section, which explains the use of logical

operators and the importance of parentheses in constructing effective search queries.

 Data Collection Status: FortiSIEM displays various icons to indicate the status of data collection for

different devices.

 Pause Icon: The pause icon specifically indicates that data collection is paused, but this can happen

due to several reasons.

 Common Cause for Pausing: One common cause for pausing data collection is an issue such as a

change of password, which prevents the system from authenticating and collecting data.

 Exhibit Analysis: In the provided exhibit, the presence of the pause icon next to the device suggests

that data collection has encountered an issue that has caused it to pause.

 Reference: FortiSIEM 6.3 User Guide, Device Management and Data Collection Status Icons section,

which explains the different icons and their meanings.

 Anomaly Baseline Data: Anomaly baseline data refers to the statistical profiles and baselines

calculated for various parameters to detect deviations indicative of potential security incidents.

 Profile DB: The Profile DB is specifically designed to store such baseline data in FortiSIEM.

Purpose: It maintains statistical profiles for different monitored parameters to facilitate anomaly

detection.

Usage: This data is used by FortiSIEM to compare real-time metrics against the established baselines

to identify anomalies.

 Reference: FortiSIEM 6.3 User Guide, Database Architecture section, which describes the different

databases used in FortiSIEM and their purposes, including the Profile DB for storing anomaly baseline

data.

 License Renewal Process: When renewing a FortiSIEM license, it is essential to provide the system

ID, which uniquely identifies the FortiSIEM instance.

 Commands to Retrieve System ID:

phgetHWID: This command retrieves the hardware ID of the FortiSIEM appliance.

Usage: Run the command phgetHWID in the CLI to obtain the hardware ID.

phgetUUID: This command retrieves the universally unique identifier (UUID) for the FortiSIEM

system.

Usage: Run the command phgetUUID in the CLI to obtain the UUID.

 Verification: Both phgetHWID and phgetUUID are valid commands for retrieving the necessary

system IDs required for license renewal.

 Reference: FortiSIEM 6.3 Administration Guide, Licensing section details the commands and

procedures for obtaining system identification information necessary for license renewal.

 Incident Creation in FortiSIEM: Incidents in FortiSIEM are created based on specific patterns and

conditions defined within the system.

 Group By Function: The "Group By" section in the "Edit SubPattern" window specifies how the data

should be grouped for analysis and incident creation.

 Impact of Grouping: The way data is grouped affects the number of incidents generated. Each

unique combination of the grouped attributes results in a separate incident.

 Exhibit Analysis: In the provided exhibit, the "Group By" section lists "Reporting Device," "Reporting

IP," and "User." This means incidents will be created for each unique combination of these attributes.

 Reference: FortiSIEM 6.3 User Guide, Rule and Pattern Creation section, which details how grouping

impacts incident generation.

 Rules Engine in FortiSIEM: The rules engine evaluates incoming events based on defined conditions

to detect incidents and anomalies.

 Aggregation Condition: The aggregation condition instructs FortiSIEM to summarize and count the

matching evaluated data.

Function: Aggregation is used to group events based on specified criteria and then perform

operations such as counting the number of occurrences within a defined time window.

 Purpose: This allows for the detection of patterns and anomalies, such as a high number of failed

login attempts within a short period.

 Reference: FortiSIEM 6.3 User Guide, Rules Engine section, which explains how aggregation is used

to summarize and count matching data.

 Grouping Events in FortiSIEM: Grouping events by specific attributes allows for the aggregation of

similar events, providing clearer insights and reducing clutter.

 Grouping Criteria: For this question, events are grouped by "User," "Source IP," and "Application

Category."

 Unique Combinations Analysis:

Ryan, 1.1.1.1, Web App (appears multiple times but is one unique combination)

John, 5.5.5.5, DB

Paul, 3.3.2.1, Web App

Ryan, 1.1.1.15, DB

Wendy, 1.1.1.6, DB

 Result Calculation: There are five unique combinations in the provided data based on the specified

grouping attributes.

 Reference: FortiSIEM 6.3 User Guide, Event Management and Reporting sections, which explain

how to group events by various attributes for analysis and reporting purposes.

 FortiSIEM Architecture: The FortiSIEM architecture includes several components such as

Supervisors, Workers, Collectors, and Agents, each playing a distinct role in the SIEM ecosystem.

 Real-Time Event Correlation: Real-time event correlation is a critical function that involves analyzing

and correlating incoming events to detect patterns indicative of security incidents or operational

issues.

 Role of Supervisor and Worker:

Supervisor: The Supervisor oversees the entire FortiSIEM system, coordinating the processing and

analysis of events.

Worker: Workers are responsible for processing and correlating the events received from Collectors

and Agents.

 Collaboration for Correlation: Together, the Supervisor and Worker components perform real-time

event correlation by distributing the load and ensuring efficient processing of events to identify

incidents in real-time.

 Reference: FortiSIEM 6.3 User Guide, Event Correlation and Processing section, details how the

Supervisor and Worker components collaborate for real-time event correlation.