FCP FortiSIEM & Security Monitoring Flashcards

What is the primary function of FortiSIEM in a security operations environment?

Answer: Unified security information and event management combining log correlation, analytics, and compliance

FortiSIEM provides a unified SIEM platform that ingests, correlates, and analyzes logs and events from diverse IT and security sources for threat detection and compliance.

In FortiSIEM, what is a 'Rule' used for?

Answer: Defining correlation logic that triggers incidents when event patterns are matched

Rules in FortiSIEM define event correlation conditions — when logs match the specified pattern, FortiSIEM automatically generates an incident.

Which FortiSIEM component is responsible for parsing raw log data into structured event attributes?

Answer: Event parser

The event parser in FortiSIEM processes raw log strings and extracts structured fields such as source IP, user, and action for downstream correlation.

What is the role of the FortiSIEM CMDB?

Answer: Maintaining an inventory of discovered devices, their attributes, and relationships

The FortiSIEM CMDB (Configuration Management Database) automatically discovers and catalogs network assets, enabling context-aware event correlation.

Which FortiSIEM deployment component is typically placed in remote sites to collect and forward logs to the supervisor?

Answer: FortiSIEM Collector

The FortiSIEM Collector is deployed at remote locations to aggregate logs from local devices and forward them to the central Supervisor for analysis.

In FortiSIEM, what does 'baseline deviation' detection help identify?

Answer: Anomalous user or device behavior that differs significantly from established normal patterns

Baseline deviation detection compares current activity against learned normal behavior to flag anomalies that may indicate insider threats or compromised accounts.