Exam NSE5_FSM-6.3 Topic 2 Question 8 Discussion
Actual exam question for Fortinet's NSE5_FSM-6.3 exam
Question #: 8
Topic #: 2
Question #: 8
Topic #: 2
Refer to the exhibit.
The FortiSIEM administrator is examining events for two devices to investigate an issue. However, the administrator is not getting any results from their search.
Based on the selected filters shown in the exhibit, why is the search returning no results?
The FortiSIEM administrator is examining events for two devices to investigate an issue. However, the administrator is not getting any results from their search.
Based on the selected filters shown in the exhibit, why is the search returning no results?
Suggested Answer: A Vote an answer
Search Filters in FortiSIEM: When searching for events, the correct use of filters and logical operators is crucial to obtain accurate results.
Issue Analysis:
* Selected Filters: The exhibit shows filters for two different Reporting IP addresses.
* Logical Operators: The use of "AND" between the two Reporting IP addresses implies that an event must match both IP addresses simultaneously, which is not possible for a single event.
Correct Usage: To search for events from either of the two IP addresses, parentheses should be used to group conditions logically.
* Corrected Filter:(Reporting IP = 192.168.1.1 OR Reporting IP = 172.16.10.3)would return events from either IP address.
References: FortiSIEM 6.3 User Guide, Search and Filters section, which explains the use of logical operators and the importance of parentheses in constructing effective search queries.
Issue Analysis:
* Selected Filters: The exhibit shows filters for two different Reporting IP addresses.
* Logical Operators: The use of "AND" between the two Reporting IP addresses implies that an event must match both IP addresses simultaneously, which is not possible for a single event.
Correct Usage: To search for events from either of the two IP addresses, parentheses should be used to group conditions logically.
* Corrected Filter:(Reporting IP = 192.168.1.1 OR Reporting IP = 172.16.10.3)would return events from either IP address.
References: FortiSIEM 6.3 User Guide, Search and Filters section, which explains the use of logical operators and the importance of parentheses in constructing effective search queries.
by Kerr at Jan 29, 2025, 10:30 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).