Fortinet Certified Solution Specialist: Security Operations 7.6 Architect & Analyst Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D0

  - * Understanding the Playbook Requirements: * The SOC analyst needs to design a playbook that filters for high severity events. * The playbook must also attach the event information to an existing incident. * Analyzing the Provided Exhibit: * The exhibit shows the available actions for a local connector within the playbook. * Actions listed include: * Update Asset and Identity * Get Events * Get Endpoint Vulnerabilities * Create Incident * Update Incident * Attach Data to Incident * Run Report * Get EPEU from Incident * Evaluating the Options: * Get Events:This action retrieves events but does not attach them to an incident. * Update Incident:This action updates an existing incident but is not specifically for attaching event data. * Update Asset and Identity:This action updates asset and identity information, not relevant for attaching event data to an incident. * Attach Data to Incident:This action is explicitly designed to attach additional data, such as event information, to an existing incident. * Conclusion: * The correct action to use in the playbook for filtering high severity events and attaching the event information to an incident isAttach Data to Incident. References: * Fortinet Documentation on Playbook Actions and Connectors. * Best Practices for Incident Management and Playbook Design in SOC Operations.