Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

In FortiSIEM Analytics and User and Entity Behavior Analytics (UEBA) search configurations, filter conditions rely on exact attribute-operator syntax to accurately target specific user actions. To isolate events generated by a specific user such as JSmith, the User attribute combined with the exact-match operator IS (i.e., User IS jsmith) is utilized. This precise condition ensures that the analytics engine maps the failed login event directly to the specified target identity without catching unrelated accounts or partial string matches. Applying this targeted condition guarantees that UEBA risk scoring and tag assignments are correctly evaluated against the intended user account within FortiSIEM's analytics framework.

A. User = smith: This evaluates the username "smith" instead of "jsmith", failing to target the specified user's failed login events.

B. Username NOT END WITH jsmith: This negative match condition explicitly excludes events associated with jsmith rather than selecting them for tag application.

D. Username CONTAIN smit: This uses an overly broad substring match that incorrectly captures unrelated users containing "smit" such as "smithson".

1. Fortinet FortiSIEM 7.4.0 Technical Documentation

"Analytics Search and Filter Syntax"

Chapter: User and Entity Behavior Analytics.

2. Fortinet FortiSIEM 7.4.0 User Guide

Section: "Configuring Analytics Rules and UEBA Tags".