Which statement about thresholds is true?

In FortiSIEM, performance monitoring thresholds define specific operational limits that trigger system alerts when resource metrics, such as CPU utilization, memory usage, or disk space, breach designated baselines. FortiSIEM supports both global and per-device thresholds for performance metrics to manage monitoring efficiently. Global thresholds establish a system-wide default policy applied across all discovered and monitored devices. To accommodate specialized infrastructure requirements, administrators can configure per-device thresholds that override global settings for specific devices. This dual-layer architecture ensures consistent baseline monitoring across the entire network infrastructure while providing the technical flexibility required to customize thresholds for high-performance servers, critical network devices, or specialized security appliances without affecting other systems.

A: FortiSIEM thresholds are fully customizable by administrators and are not hardcoded or fixed values.

B: FortiSIEM uses security rules for security events, whereas thresholds apply to performance metrics.

D: FortiSIEM allows device-specific thresholds to override global defaults, so it does not rely exclusively on global thresholds.

- Fortinet FortiSIEM 7.0.0 Administration Guide

Section: "Configuring Performance Thresholds"

pp. 412-415.

- Fortinet FortiSIEM 7.1.0 User Guide

Section: "Metrics and Performance Threshold Configuration".