FCP FortiAnalyzer & Log Management Flashcards

What is the primary role of FortiAnalyzer in the Fortinet Security Fabric?

Answer: Centralized log collection, analysis, and reporting

FortiAnalyzer serves as the centralized log management and analytics platform for collecting, correlating, and reporting on data from Fortinet devices.

Which FortiAnalyzer feature allows administrators to create automated responses based on log data thresholds?

Answer: Event handlers

Event handlers in FortiAnalyzer let administrators define conditions and trigger automated actions or alerts when log data meets specified thresholds.

What does ADOM stand for in FortiAnalyzer?

Answer: Administrative Domain

ADOM stands for Administrative Domain, which is used in FortiAnalyzer to segment management and log data by organization or department.

In FortiAnalyzer, which log type records traffic allowed or denied by FortiGate firewall policies?

Answer: Traffic logs

Traffic logs capture sessions that are permitted or blocked by FortiGate firewall policies, recording source, destination, and action taken.

What FortiAnalyzer feature enables long-term storage of raw logs in a compressed archive format?

Answer: Log archiving

FortiAnalyzer's log archiving feature compresses and stores raw logs for extended periods to meet compliance and forensic investigation needs.

Which FortiAnalyzer component allows administrators to build custom queries against the log database?

Answer: Datasets

Datasets in FortiAnalyzer are SQL-like queries that extract specific data from the log database, forming the basis for custom reports and charts.