Fortinet

FCSS_SOC_AN-7.4
FCSS - Security Operations 7.4 Analyst
QUESTION & ANSWERS

[Link]
QUESTION: 1

Refer to the Exhibit:

An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious
attachment event based on FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS
integrated with FortiSandbox. All devices are logging to FortiAnalyzer. Which connector must the analyst use
in this playbook?

Option A : FortiSandbox connector

Option B : FortiClient EMS connector

Option C : FortiMail connector

Option D : Local connector

Correct Answer: A

Explanation/Reference:

Understanding the Requirements: The objective is to create an incident and generate a report based on malicious attachment

events detected by FortiAnalyzer from FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS, which is

integrated with FortiSandbox. All logs are sent to FortiAnalyzer. Key Components: FortiAnalyzer: Centralized logging and

analysis for Fortinet [Link]: Advanced threat protection system that analyzes suspicious files and URLs.

[Link]
FortiClient EMS: Endpoint management system that integrates with FortiSandbox for endpoint protection. Playbook Analysis:

The playbook in the exhibit consists of three main actions:GET_EVENTS,RUN_REPORT, andCREATE_INCIDENT. EVENT_TRIGGER:

Starts the playbook when an event occurs. GET_EVENTS: Fetches relevant events. RUN_REPORT: Generates a report based on

the events. CREATE_INCIDENT: Creates an incident in the incident management system. Selecting the Correct Connector: The

correct connector should allow fetching events related to malicious attachments analyzed by FortiSandbox and facilitate

integration with FortiAnalyzer. Connector Options: FortiSandbox Connector: Directly integrates with FortiSandbox to fetch

analysis results and events related to malicious attachments. Best suited for getting detailed sandbox analysis results.

Selected as it is directly related to the requirement of handling FortiSandbox analysis events. FortiClient EMS Connector: Used

for managing endpoint security and integrating with endpoint logs. Not directly related to fetching sandbox analysis events.

Not selected as it is not directly related to the sandbox analysis events. FortiMail Connector: Used for email security and

handling email-related logs and events. Not applicable for sandbox analysis events. Not selected as it does not relate to the

sandbox [Link] Connector: Handles local events within FortiAnalyzer itself. Might not be specific enough for fetching

detailed sandbox analysis results. Not selected as it may not provide the required integration with FortiSandbox.

Implementation Steps: Step 1: Ensure FortiSandbox is configured to send analysis results to FortiAnalyzer. Step 2: Use the

FortiSandbox connector in the playbook to fetch events related to malicious attachments. Step 3: Configure

theGET_EVENTSaction to use the FortiSandbox connector. Step 4: Set up theRUN_REPORTandCREATE_INCIDENTactions based

on the fetched events. References: Fortinet Documentation on FortiSandbox Integration FortiSandbox Integration Guide

Fortinet Documentation on FortiAnalyzer Event Handling FortiAnalyzer Administration Guide By using the FortiSandbox

connector, the analyst can ensure that the playbook accurately fetches events based on FortiSandbox analysis and generates

the required incident and report.

QUESTION: 2

Which statement describes automation stitch integration between FortiGate and FortiAnalyzer?

Option A : An event handler on FortiAnalyzer executes an automation stitch when an event is created.

Option B :

An automation stitch is configured on FortiAnalyzer and mapped to FortiGate using the FortiOS connector.

Option C :

An event handler on FortiAnalyzer is configured to send a notification to FortiGate to trigger an

Option D : A security profile on FortiGate triggers a violation and FortiGate sends a webhook call to
FortiAnalyzer.

[Link]
 Correct Answer: D

Explanation/Reference:

Overview of Automation Stitches: Automation stitches in Fortinet solutions enable automated responses to specific events

detected within the network. This automation helps in swiftly mitigating threats without manual intervention. FortiGate Security

Profiles: FortiGate uses security profiles to enforce policies on network traffic. These profiles can include antivirus, web filtering,

intrusion prevention, and more. When a security profile detects a violation or a specific event, it can trigger predefined actions.

Webhook Calls: FortiGate can be configured to send webhook calls upon detecting specific security events. A webhook is an

HTTP callback triggered by an event, sending data to a specified URL. This allows FortiGate to communicate with other

systems, such as FortiAnalyzer. FortiAnalyzer Integration: FortiAnalyzer collects logs and events from various Fortinet devices,

providing centralized logging and analysis. Upon receiving a webhook call from FortiGate, FortiAnalyzer can further analyze the

event, generate reports, and take automated actions if configured to do so. Detailed Process: Step 1: A security profile on

FortiGate triggers a violation based on the defined security policies. Step 2: FortiGate sends a webhook call to FortiAnalyzer

with details of the violation. Step 3: FortiAnalyzer receives the webhook call and logs the event. Step 4: Depending on the

configuration, FortiAnalyzer can execute an automation stitch torespond to the event, such as sending alerts, generating

reports, or triggering further actions. References: Fortinet Documentation: FortiOS Automation Stitches FortiAnalyzer

Administration Guide: Details on configuring event handlers and integrating with FortiGate. FortiGate Administration Guide:

Information on security profiles and webhook configurations. By understanding the interaction between FortiGate and

FortiAnalyzer through webhook calls and automation stitches, security operations can ensure a proactive and efficient

response to security events.

QUESTION: 3

When does FortiAnalyzer generate an event?

Option A : When a log matches a filter in a data selector

Option B : When a log matches an action in a connector

Option C : When a log matches a rule in an event handler

Option D : When a log matches a task in a playbook

Correct Answer: C

[Link]
Explanation/Reference:

Understanding Event Generation in FortiAnalyzer: FortiAnalyzer generates events based on predefined rules and conditions to

help in monitoring and responding to security incidents. Analyzing the Options: Option A:Data selectors filter logs based on

specific criteria but do not generate events on their own. Option B:Connectors facilitate integrations with other systems but do

not generate events based on log matches. Option C:Event handlers are configured with rules that define the conditions under

which events are generated. When a log matches a rule in an event handler, FortiAnalyzer generates an event. Option D:Tasks

in playbooks execute actions based on predefined workflows but do not directly generate events based on log matches.

Conclusion: FortiAnalyzer generates an event when a log matches a rule in an event handler. References: Fortinet

Documentation on Event Handlers and Event Generation in FortiAnalyzer. Best Practices for Configuring Event Handlers in

FortiAnalyzer.

[Link]