20 Questions
Which of the following statements is true about incidents in FortiAnalyzer?
Incidents can be created manually or automatically with playbooks.
What is the purpose of creating an incident in FortiAnalyzer?
To prevent or mitigate security breaches.
How can an incident be created in FortiAnalyzer from Event Monitor?
By right-clicking on the desired event and selecting the corresponding option.
What information is shown on the incident analysis page in FortiAnalyzer?
Affected endpoint and user, incident's timeline, executed playbooks, and audit history.
Where can incidents be viewed in FortiAnalyzer?
Incidents tab
What is the purpose of analyzing an incident in FortiAnalyzer?
To perform a full investigation of the incident.
How can an incident be analyzed in FortiAnalyzer?
By right-clicking on the desired incident and selecting Analysis.
What tabs provide more details about an incident in FortiAnalyzer?
Comments, Events, Reports, Indicators, Affected Assets, Processes, Software, and Vulnerabilities.
Can incidents in FortiAnalyzer be created automatically with playbooks?
Yes, incidents can be created manually or automatically with playbooks.
What are some of the details shown on the incident analysis page in FortiAnalyzer?
Affected endpoint and user, incident's timeline, executed playbooks, and audit history.
Threat hunting is the process of proactively searching for suspicious or potentially risky network activity that may have gone undetected.
True
What is the purpose of configuring incident settings in FortiAnalyzer?
To keep track of the work being done to solve incidents
What is the recommended best practice for incident notifications in FortiAnalyzer?
Send notifications for all incident-related activities
What is the purpose of the Threat Hunting pane in FortiSoC?
To allow for advanced correlation and analysis to hunt for threats
How can you access the related logs of an incident in FortiAnalyzer?
By right-clicking the incident and selecting the Logs tab
What is the purpose of the Comments tab in FortiAnalyzer?
To view comments added by other analysts
What should be done once an incident is closed in FortiAnalyzer?
Delete the incident from the list
What is the purpose of the Reports tab in FortiAnalyzer?
To view existing reports
What is the purpose of configuring fabric connectors in FortiAnalyzer?
To configure external platforms for incident notifications
What is the purpose of keeping all incident settings up to date in FortiAnalyzer?
To track the work being done to solve incidents
Creating an Incident: Learn how to effectively analyze and respond to events in order to prevent security breaches. Discover when and how to create incidents manually or automatically using playbooks for further analysis.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
