FortiSIEM employs a hierarchical and flexible thresholding system for performance metrics. It provides a set of system-defined global thresholds that serve as a baseline for all monitored devices. For environments requiring more specific monitoring, administrators can configure per-device thresholds. When a per-device threshold is set for a specific metric, it takes precedence over and overrides the corresponding global threshold for that device only. This dual approach allows for both broad, generalized monitoring and granular, device-specific tuning.

A. Thresholds are not fixed or hardcoded; they are fully configurable by administrators at both the global and per-device levels to suit specific environmental needs.

B. FortiSIEM uses thresholds primarily for performance and availability metrics, not just security metrics, and it utilizes both global and device-level settings.

D. FortiSIEM does not rely solely on global thresholds. The ability to set per-device thresholds is a key feature for accurate and customized performance monitoring.

1. FortiSIEM 7.0.0 Administration Guide

Page 319

Section: "Setting Performance Monitoring Thresholds".

The document states

"FortiSIEM has a set of built-in system-defined performance monitoring rules that use global thresholds for monitored metrics... You can also define thresholds for specific devices

which will override the global thresholds." This directly confirms the use of both global and per-device thresholds for performance metrics.

2. FortiSIEM 7.0.0 Concepts Guide

Page 11

Section: "Performance and Availability Monitoring".

This guide explains

"FortiSIEM can monitor a wide variety of performance and availability metrics... and generate an event when a metric crosses a user-defined threshold." This confirms that thresholds are user-configurable

refuting the "fixed

hardcoded" claim in option A.