Fortinet Certified Solution Specialist FCSS_ADA_AR-6.7 Release Date

The administratordeployed FortiSIEM without a collector, meaning there is no dedicated system collecting logs fromservice provider infrastructure devices. Without a collector, the FortiSIEMsupervisor and workersmust directly ingest logs, which is not ideal for amulti-tenant service provider setup. Acollector is necessaryto efficiently gather logs before forwarding them to the FortiSIEM cluster.

The admin password is a mandatory field, as indicated in the exhibit ("Required" in red). It is needed for authentication and administrative access.

The organization name ("University") is necessary to associate the collector with the correct organization.

The Admin User (uniadmin) is a required field for defining the administrator of the collector.

From the provided XML configuration, we need to focus on the section, which defines the attributes used for grouping.

In theSelectClause, the following attributes are listed:

reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr)

●reptDevNamerepresents thereporting device.

●reptDevAddrrepresents thereporting IP.

●COUNT(DISTINCT user)tracks unique users.

●COUNT(DISTINCT srcIpAddr)tracks distinct source IPs.

In theGroupByAttrsection:

reptDevName, reptDevAddr

This confirms that the grouping is performed byReporting Device (reptDevName)andReporting IP (reptDevAddr).

These three processes are essential for aFortiSIEM collector, as they handle event parsing, agent communication, and system monitoring.

●phParseris responsible forparsing and processing collected logsbefore forwarding them.

●phAgentManagermanages agent communication, ensuring logs are received and forwarded correctly.

●phMonitorAgentmonitors the health of the collector itself, reporting system status to the FortiSIEM supervisor.

phReportMasterandphRuleMasterdo not run on collectors. They are supervisor/worker processes handling reporting and rule evaluation, respectively.