What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blocklisted IP addresses? (Choose one answer)

• A. A new Infected entry is added for the corresponding endpoint under Compromised Hosts.
• B. FortiAnalyzer runs a default playbook in the background that creates an incident alerting analysts.
• C. The detection engine classifies those logs as Suspicious.
• D. The endpoint is marked as Compromised and, optionally, can be quarantined.

Correct Answer: A

Brave-Dump Clients Votes