Fortinet NSE6_OTS_AR-7.6 - Questions & Answers

FortiAnalyzer needs an event handler to detect the matching attack event and start the alert workflow. The root FortiGate stitch is the automation point that can act from the Security Fabric side when the handler is triggered.

Passive discovery avoids logging in to devices. Vendor OUI identifies manufacturers from observed MAC addresses, and network traffic lets FortiGate infer protocols and hosts from packets already crossing the interface.

FortiAnalyzer report customization depends on the data query and how that data is presented. Datasets define the log data used by the report, and charts turn those datasets into report widgets for OT risk assessment.

OT signatures are subscription content, so the FortiGate needs a valid OT security service license. Setting exclude-signatures to none prevents OT signatures from being filtered out of the inspection database.

A Basic Event Handler still needs matching rules on FortiAnalyzer so the alert condition is defined. With Automation Stitch enabled, FortiGate must also use a FortiAnalyzer event handler trigger to call that handler from the automation workflow.

Run Report can list only reports prepared for playbook execution. Extended Log Filtering makes the report usable with event-driven filters, and Auto-cache makes a generated report instance available for automated selection.

The profile contains OT application entries, so OT signatures are active in the Application Control sensor. The IEC entries are handled by monitored or blocked application rules, which produces logs for IEC command activity.

Supported OT protocols are identified through application inspection, not general device discovery. Enabling OT signatures supplies the protocol definitions, and an Application Control profile in monitor mode observes matching OT traffic.

Secure remote access through Edge-FortiGate needs an encrypted access path and strong user verification. IPsec supplies the VPN tunnel over the Internet, while FortiToken adds two-factor authentication for the supervisor.