ReportAI
FortiSIEM includes over 100 pre-built questions that you can ask, listed in Resources > ReportAI. These questions are categorized in the following ReportAI sub folders: CMDB, Data Collection, Document, Incident, Performance, Threat Hunting, User Activity, Vulnerability, and Ungrouped. These System Scope questions cannot be modified, but can be cloned to use as a basic template.
|
Column |
Description |
|---|---|
| Question | A specific request for information. |
| Notes | Any notes made about a question appear here. |
| Scope | Identifies whether the question is built-in, displayed as System, or user created, displayed as User. |
| Last Modified | The date and time the question was modified. |
To clone a question, select a question and click the Clone (
) icon.
To ask a question, select the question you wish to ask, then click Run (
). A FortiAI Chat window will appear with the question. When you are ready to submit your question, click Send (
). For more details, see FortiAI.
To edit a User Scope question, select it, then click the Edit (
) icon.
To delete a User Scope question, select it, then click the Delete (
) icon.