The rule engine in FortiSIEM loads baseline data values from the profile database . This database stores historical trends and behavioral baselines for various metrics, such as CPU usage, network activity, and authentication patterns .

● Profile database maintains long-term aggregated statistics for anomaly detection.

● Baseline values are used to compare current events against expected behavior.

● This helps in detecting deviations , such as a sudden increase in failed logins or unusual traffic spikes.

FortiSIEM does not allow CMDB queries to be nested within other CMDB queries. CMDB data is static information, and nesting would not add value or function properly in query execution.

The LookupTableHas function is used to check whether a specified key exists in a lookup table . It returns either true or false , depending on whether the key is found in the table.

● If the key is present, the function returns true .

● If the key is absent, the function returns false .

phRuleMaster runs on both the supervisor and worker nodes, allowing distributed event processing. It receives filtered data from phRuleWorkers and organizes it into buckets before evaluation. Every 30 seconds, it processes the rule data in parallel, ensuring efficient rule execution. The incorrect options suggest that phRuleMaster runs only on the supervisor or evaluates rules sequentially, both of which are inaccurate.

FortiSOAR supports multiple data ingestion modes to allow efficient data collection and automation. The three primary modes are:

1. Rule-Based

FortiSOAR ingests data when specific rules are triggered based on defined conditions.

This enables automation and intelligence-driven event ingestion.

2. App Push

External applications can push data into FortiSOAR using APIs and integrations .

This is useful for real-time ingestion from external tools like SIEMs, ticketing systems, and threat intelligence platforms.

3. Schedule-Based

Data is ingested based on predefined schedules .

This is useful for periodic polling of external systems, fetching logs, and running automated tasks at set intervals.

In FortiSIEM , numPoints is a parameter used in rules and the profile database to ensure the reliability of statistical baselines and prevent anomalies from being falsely triggered due to insufficient data.

1. To prevent premature triggering of a rule before a baseline is set and becomes active.

numPoints ensures that a rule does not trigger until a sufficient number of data points are collected for the baseline.

Without enough data, the system may generate false positives due to the lack of a stable historical pattern.

2. To fetch only values from the profile database that have numPoints greater than a certain threshold.

When querying the profile database , numPoints acts as a filter to ensure that only data points meeting a minimum threshold are considered for analysis.

This prevents unreliable or insufficient historical data from affecting anomaly detection.

The exhibit shows the directory listings for three different workers ( worker1 , worker2 , and worker3 ) under the /querywkr/active/13127* path, which indicates active query tasks assigned to each worker.

1. Worker1 ( worker1 )

The output does not show any subdirectories or task files ( 13127t0 , 13127t1 , etc.), meaning Worker1 is not assigned any tasks .

2. Worker2 ( worker2 )

The output shows one task ( 13127t1 ) under /querywkr/active/13127* .

The worker has only one assigned task, not two , so options C and D are incorrect .

3. Worker3 ( worker3 )

The output shows two tasks ( 13127t0 and 13127t1 ) , indicating that Worker3 is processing two tasks for query ID 13127.