Question 18 - FCP_FAZ_AN-7.4 discussion

In the exhibit, we see a playbook in FortiAnalyzer designed to retrieve events based on specific criteria, create an incident, and attach relevant data to that incident. The 'Get Event' task configuration specifies filters to match any of the following conditions:

Severity = High

Event Type = Web Filter

Tag = Malware

Analysis of Events:

In the FortiAnalyzer Event Monitor list:

We need to identify events that meet any one of the specified conditions (since the filter is set to 'Match Any Condition').

Events Matching Criteria:

Severity = High:

There are two events with 'High' severity, both with the 'Event Type' IPS.

Event Type = Web Filter:

There are two events with the 'Event Type' Web Filter. One has a 'Medium' severity, and the other has a 'Low' severity.

Tag = Malware:

There are two events tagged with 'Malware,' both with the 'Event Type' Antivirus and 'Medium' severity.

After filtering based on these criteria, there are four distinct events:

Two from the 'Severity = High' filter.

One from the 'Event Type = Web Filter' filter.

One from the 'Tag = Malware' filter.

Conclusion:

Correct Answe r : D. Four events will be added.

This answer matches the conditions set in the playbook filter configuration and the events listed in the Event Monitor.

FortiAnalyzer 7.4.1 documentation on event filtering, playbook configuration, and incident management criteria.