FCP FortiSIEM & Security Monitoring Flashcards

What is the purpose of FortiSIEM's 'Watch List' feature?

Answer: Tracking specific users, IPs, or devices for heightened monitoring and alerting

Watch Lists in FortiSIEM allow analysts to tag specific identities or assets for elevated scrutiny, ensuring any associated events receive higher priority.

Which FortiSIEM feature maps detected incidents to MITRE ATT&CK tactics and techniques?

Answer: MITRE ATT&CK mapping in incident details

FortiSIEM can tag incidents with corresponding MITRE ATT&CK tactics and techniques, helping analysts understand attacker behavior within a structured framework.

In a multi-tenant FortiSIEM deployment, how are different customer environments kept isolated?

Answer: Organizations (orgs) provide logical separation of devices, events, and policies per tenant

FortiSIEM uses Organizations (orgs) to logically isolate each tenant's devices, events, rules, and dashboards within a single shared deployment.

What is the function of FortiSIEM's 'Real-Time Search'?

Answer: Querying incoming events live as they arrive without needing a stored log index

Real-Time Search in FortiSIEM lets analysts filter and examine events as they stream in, enabling immediate threat hunting without waiting for indexing.

Which FortiSIEM protocol integration is commonly used to pull performance and availability metrics from network devices?

Answer: SNMP

FortiSIEM uses SNMP to poll network devices for performance counters, interface statistics, and availability data for infrastructure monitoring.

What does FortiSIEM's 'Incident Notification' feature enable?

Answer: Sending automated alerts via email, SMS, or ticketing system when incidents are triggered

Incident Notifications allow FortiSIEM to automatically contact analysts via email, SMS, or integrate with ticketing systems like ServiceNow when a new incident fires.