FCSS_SOC Question 6

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B0

  ,D - * Understanding Incident Creation in FortiAnalyzer: * FortiAnalyzer allows for the creation of incidents to track and manage security events. * Incidents can be created both automatically and manually based on detected events and predefined rules. * Analyzing the Methods: * Option A:Using a connector action typically involves integrating with other systems or services and is not a direct method for creating incidents on FortiAnalyzer. * Option B:Incidents can be created manually on the Event Monitor page by selecting relevant events and creating incidents from those events. * Option C:While playbooks can automate responses and actions, the direct creation of incidents is usually managed through event handlers or manual processes. * Option D:Custom event handlers can be configured to trigger incident creation based on specific events or conditions, automating the process within FortiAnalyzer. * Conclusion: * The two valid methods for creating an incident on FortiAnalyzer are manually on the Event Monitor page and using a custom event handler. References: * Fortinet Documentation on Incident Management in FortiAnalyzer. * FortiAnalyzer Event Handling and Customization Guides.