You are asked to configure a query to run every 15 minutes, automatically searching for specific registry modifications across all endpoints. Which…

FortiEDR's Threat Hunting module allows administrators to proactively search for indicators of compromise, such as specific registry modifications, file creations, or process executions. To automate this process, you must configure a scheduled query within a threat hunting profile. This feature enables the system to automatically execute predefined Lucene-based queries at specified intervals (e.g., every 15 minutes) across all endpoints. The results are continuously monitored, and alerts can be generated if the query returns matches for suspicious activities.

A. Communication control rules manage and restrict network traffic; they do not query endpoint telemetry or search for registry modifications.

B. Manual queries are executed on-demand by an analyst and cannot be automated or scheduled to run at regular intervals.

D. Playbooks are reactive mechanisms that respond to generated security events; they do not proactively query endpoints for raw telemetry.

1. Fortinet Inc., "FortiEDR 5.2 Administration Guide," Document ID: 09-520-735193-20210916, Section: Threat Hunting -> Scheduled Queries, pp. 302-305.

2. Fortinet Inc., "FortiEDR Security Architecture and Operations," NSE 6 Courseware, Module 6: Threat Hunting.