 Offline Licensing in FortiSIEM: FortiSIEM provides mechanisms for offline licensing to accommodate

environments without direct internet access.

 License Tool Command: The command ./phLicenseTool --collect license_req.dat is used to collect

license information necessary for offline registration.

 Procedure Analysis: The exhibit shows the output of this command, which indicates the collection of

license information to a file named license_req.dat.

 Offline License Registration: This collected data file is then typically uploaded to the FortiSIEM

support portal or provided to the FortiSIEM support team for processing and generating a license file.

 Reference: FortiSIEM 6.3 Administration Guide, Licensing section, details the procedures for both

online and offline license registration, including the use of the phLicenseTool for offline scenarios.

 Device Discovery Information: Information about discovered devices, including their configurations

and statuses, is stored in a specific database.

 CMDB: The Configuration Management Database (CMDB) is used to store detailed information

about the devices discovered by FortiSIEM.

Function: It maintains comprehensive details about device configurations, relationships, and other

metadata essential for managing the IT infrastructure.

 Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a

centralized repository of device information, facilitating efficient management and monitoring.

 Reference: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which

details the storage and usage of device discovery information.

 Raw Log Data: When devices send logs to FortiSIEM, the data arrives in a raw, unstructured format.

 Data Parsing Process: The process that converts this raw log data into a structured format is known

as data parsing.

Data Parsing: This involves extracting relevant fields from the raw log entries and organizing them

into a structured format, making the data usable for analysis, reporting, and correlation.

 Significance of Structured Data: Structured data is essential for effective event correlation, alerting,

and generating meaningful reports.

 Reference: FortiSIEM 6.3 User Guide, Data Parsing section, which details how raw log data is

transformed into structured data through parsing.

 Expression Builder in FortiSIEM: The Expression Builder is used to create expressions for analyzing

event data.

 Correct Syntax: The correct syntax for counting matched events is COUNT(Matched Events).

Function: COUNT is a function that takes a parameter, in this case, "Matched Events," to count the

number of occurrences.

 Common Errors: Incorrect syntax, such as reversing the order or using parentheses improperly, can

lead to invalid expressions.

 Reference: FortiSIEM 6.3 User Guide, Expression Builder section, which explains the correct syntax

and usage for creating valid expressions for event analysis.

 Incident Creation in FortiSIEM: Incidents in FortiSIEM are created based on specific patterns and

conditions defined within the system.

 Group By Function: The "Group By" section in the "Edit SubPattern" window specifies how the data

should be grouped for analysis and incident creation.

 Impact of Grouping: The way data is grouped affects the number of incidents generated. Each

unique combination of the grouped attributes results in a separate incident.

 Exhibit Analysis: In the provided exhibit, the "Group By" section lists "Reporting Device," "Reporting

IP," and "User." This means incidents will be created for each unique combination of these attributes.

 Reference: FortiSIEM 6.3 User Guide, Rule and Pattern Creation section, which details how grouping

impacts incident generation.