FCP FortiSIEM & Security Monitoring Flashcards

In FortiSIEM, what is the purpose of a 'Business Service'?

Answer: Grouping devices and applications that together deliver a business function for impact-based risk scoring

Business Services in FortiSIEM group related IT assets (servers, network devices, applications) that support a business function, enabling risk scoring based on service impact.

Which FortiSIEM feature allows automated remediation actions to be triggered when an incident is created?

Answer: Incident notification with remediation script execution

FortiSIEM can execute remediation scripts automatically upon incident creation, enabling rapid response actions such as blocking an IP or quarantining a device.

What is the significance of the FortiSIEM 'Risk Score' assigned to devices?

Answer: It quantifies the combined threat and vulnerability exposure of a device based on recent incidents and scan data

FortiSIEM's Risk Score combines incident severity, vulnerability data, and asset criticality to give each device a composite risk rating for prioritized response.

Which FortiSIEM integration allows it to automatically create and update tickets in external ITSM platforms?

Answer: Ticketing system integration via REST API or built-in connectors (e.g., ServiceNow, Jira)

FortiSIEM integrates with ITSM platforms like ServiceNow and Jira via REST API connectors, automatically creating or updating tickets when incidents are detected.

In FortiSIEM, what does the 'Analytics' tab primarily provide to security analysts?

Answer: Advanced ad-hoc querying and visualization of historical event data for threat hunting

The Analytics tab in FortiSIEM provides powerful query and visualization tools for exploring historical log data, supporting threat hunting and forensic investigations.

What is the purpose of FortiSIEM's 'Identity and Location' feature?

Answer: Mapping IP addresses to user identities and physical or network locations for enriched event context

FortiSIEM's Identity and Location feature enriches events by resolving IP addresses to user accounts and physical or network locations, improving investigation context.