What are two required components of a rule? (Choose two.)

In FortiSIEM, rules are constructed using specific mandatory and optional configuration components within the Rule Builder. When defining a rule, every rule must contain at least one Subpattern (which specifies the event filters, aggregate conditions, group-by attributes, and evaluation time window required to match incoming log events) and a designated Detection Technology (such as Log/Event-based, Statistical, or Machine Learning). Without these two mandatory building blocks, a rule cannot evaluate incoming event streams or generate incidents. In contrast, exception policies and clear policies are optional settings used to override rule actions or automatically resolve incidents under specified conditions.

Option A: An exception policy is an optional rule setting used to exclude specific benign events or behavior from triggering incident generation.

Option D: A clear policy is an optional rule component that defines criteria for automatically setting an open incident state to cleared.

- Fortinet Documentation Library

FortiSIEM 7.1.0 Rule Overview and Configuration Guide

Section: "Rule Architecture and Subpatterns"

pp. 112-115.

- Fortinet Technical Documentation

FortiSIEM Analytics and Rules Engine Reference Guide

Document ID: 08-700-814041-2023

Section: "Defining Rules and Subpatterns".