:

:

When you frequently use the same search parameters in FortiAnalyzer’s Log View, setting up a

reusable filter or view can save considerable time. Here’s an analysis of each option:

Option A - Configure a Custom Dashboard:

Custom dashboards are useful for displaying a variety of widgets and summaries on network activity,

performance, and threat data, but they are not designed for storing specific search filters for log

views.

Conclusion: Incorrect.

Option B - Configure a Custom View:

Custom views in FortiAnalyzer allow analysts to save specific search filters and configurations. By

setting up a custom view, you can retain your frequently used search parameters and quickly access

them without needing to reapply filters each time. This option is specifically designed to streamline

the process of recurring log searches.

Conclusion: Correct.

Option C - Configure a Data Selector:

Data selectors are used to define specific types of data for FortiAnalyzer reports and widgets. They

are useful in reports but are not meant for saving and reusing log search parameters in Log View.

Conclusion: Incorrect.

Option D - Configure a Macro and Apply It to Device Groups:

Macros in FortiAnalyzer are generally used for automation tasks, not for saving log search filters.

Applying macros to device groups does not fulfill the requirement of saving specific log view search

parameters.

Conclusion: Incorrect.

Conclusion:

Correct Answe r : B. Configure a custom view.

Custom views allow you to save specific search filters, enabling quick access to frequently used

parameters in Log View.

Reference:

FortiAnalyzer 7.4.1 documentation on creating and using custom views for log searches.

:

In FortiAnalyzer's incident management system, analysts have the option to manually manage

incidents, which includes attaching relevant reports to an incident for further investigation and

documentation. This feature allows analysts to consolidate information, such as detailed reports on

suspicious activity, into an incident record, providing a comprehensive view for incident response.

Let's review the other options to clarify why they are incorrect:

Option A: You can manually attach generated reports to incidents

This is correct. FortiAnalyzer allows analysts to manually attach reports to incidents, which is

beneficial for providing additional context, evidence, or analysis related to the incident. This

functionality is part of the incident management process and helps streamline information for

tracking and resolution.

Option B: The status of the incident is always linked to the status of the attached event

This is incorrect. The status of an incident on FortiAnalyzer is managed independently of the status of

any attached events. An incident can contain multiple events, each with different statuses, but the

incident itself is tracked separately.

Option C: Severity incidents rated with the level High have an initial service-level agreement (SLA)

response time of 1 hour

This is incorrect. While incidents have severity levels, specific SLA response times are typically set

according to the organization’s incident response policy, and FortiAnalyzer does not impose a default

SLA response time of 1 hour for high-severity incidents.

Option D: Incidents must be acknowledged before they can be analyzed

This is incorrect. Incidents on FortiAnalyzer can be analyzed even if they are not yet acknowledged.

Acknowledging an incident is often part of the workflow to mark it as being actively addressed, but it

is not a prerequisite for analysis.

Reference: According to FortiAnalyzer documentation, analysts can attach reports to incidents

manually, making option A correct. This feature enables better tracking and documentation within

the incident management system on FortiAnalyzer​.