Review the incident report An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails. The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain. Which two MITRE ATT&CK tactics best fit this report? (Choose two answers)

Which three are threat hunting activities? (Choose three answers)

Refer to the exhibit.



How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer)

Refer to the exhibits.





Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment. Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two answers)

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)