In FortiSIEM, the machine learning "Running Mode" determines where ML tasks are processed. The Local mode configures the Supervisor node to perform both model training and anomaly detection. This concentration of tasks on a single node makes it highly CPU and memory-intensive, creating a performance bottleneck that significantly increases the time required to complete ML tasks, especially in larger environments. In contrast, the "Local auto" mode offloads the detection workload to Worker nodes, distributing the processing and improving overall efficiency.

A. Local auto: This mode is more efficient because it distributes the anomaly detection workload to Worker nodes, reducing the processing time and load on the Supervisor.

C. Forecasting: This is a type of machine learning algorithm used for predicting future values, not a FortiSIEM operational running mode for ML processing.

D. Regression: This is a category of supervised machine learning algorithms used for predicting continuous outcomes, not a FortiSIEM operational running mode.

---

1. FortiSIEM 7.0.0 Administration Guide

Page 331

Section: "Configuring Machine Learning".

The guide states: "In Local mode

the Supervisor node trains the model and detects anomalies. This mode is CPU and memory intensive."

It also states: "In Local auto mode

the Supervisor node trains the model

but the anomaly detection is offloaded to the Worker nodes. This mode is recommended for large deployments." This distinction confirms that the Local mode centralizes the workload

leading to longer processing times compared to the distributed Local auto mode.