Which run mode takes the most time to perform machine learning tasks?

In FortiSIEM Machine Learning features, including baseline profiling and User and Entity Behavior Analytics, execution run modes dictate how analytical models are trained and executed. The Local Auto run mode requires the most processing time because it performs fully automated hyperparameter tuning and model optimization locally on the FortiSIEM supervisor or worker nodes. Unlike standard execution modes that rely on default static parameters, Local Auto runs continuous parameter grid searches, extensive cross-validation, and repeated iterative model evaluations to dynamically optimize accuracy for the specific environment. Consequently, this intensive local computational workflow demands significant CPU and memory resources, resulting in the longest execution time among all available ML run modes.

B: Local mode uses default, pre-configured hyperparameters without running exhaustive tuning searches, completing faster than Local Auto.

C: Forecasting is an analytical baseline calculation method, not an automated hyperparameter-tuning ML run mode.

D: Regression is a mathematical algorithm classification, not a FortiSIEM execution run mode setting.

- Fortinet FortiSIEM 7.0.0 UEBA and ML Guide

Section: "Configuring Machine Learning Run Modes"

pp. 28-31.

- Fortinet FortiSIEM 7.1.0 Analytics Guide

Section: "Machine Learning Profile Execution Settings".