Skip to main content
Training Institute
  • Library
  • Schedule
  • Certifications
  • ATC
  • Academic Partner Program
  • Fast Track Workshops
  • More
Log in
Contents
Library Schedule Certifications ATC Academic Partner Program Fast Track Workshops

FortiNDR Cloud Analyst

Blocks

Certification

This exam is part of the following certification track:

Visit the Cybersecurity Certification page for information about certification requirements.

Exams available at Pearson VUE are listed below. Select an exam to view the details.

Fortinet NSE 6 - FortiNDR Cloud 26 Analyst

Status: Available

The Fortinet NSE 6 - FortiNDR Cloud 26 Analyst exam evaluates your knowledge of, and expertise with, FortiNDR Cloud to identify and investigate security incidents.

This exam tests your applied knowledge of FortiNDR Cloud configuration and operation, and includes operational scenarios, incident analysis, integration with third party products, and troubleshooting scenarios.

Once you pass the exam, you will receive the following exam badge:

Audience

The Fortinet NSE 6 - FortiNDR Cloud 26 Analyst exam is intended for network and security professionals responsible for the detection and analysis of security incidents using FortiNDR Cloud.

Exam Details
Exam name Fortinet NSE 6 - FortiNDR Cloud 26 Analyst
Time allowed 65–75 minutes
Exam questions 30–40 questions
Scoring Pass or fail. A score report is available from your Pearson VUE account.
Language English
Product version FortiNDR Cloud 26
Exam Topics

Successful candidates have applied knowledge and skills in the following areas and tasks:

Architecture and system settings (15–25% of the exam)
Tasks Details
Explain the FortiNDR Cloud architecture
  • Fortinet FortiNDR offerings
  • FortiNDR Cloud SaaS offering
  • Back-end concepts
  • Entity information extraction
  • Enrichment
  • Detection matching and intelligence correlation
  • Data storage
  • Features of the front end
  • Portal management
  • Use cases (display mode, subscription provisioning, annotation provisioning)
Identify the FortiNDR Cloud sensors
  • FortiNDR Cloud sensors
  • Sensor types
  • Sensor data
  • Sensor registration
  • Metadata production
  • Event types
  • Special considerations
  • Use cases: sensors, MITRE ATT&CK detections, frameworks
Events and queries (25–35% of the exam)
Tasks Details
Explain event types and fields
  • Protocol definition (Flow, DNS, HTTP, SSL, SMB, DEC/RPC)
  • Key available fields (Flow, DNS, HTTP, SSL, SMB, DEC/RPC)
  • Security implications (Flow, DNS, HTTP, SSL, SMB, DEC/RPC)
  • Use cases: flow events (fields, sub-fields, metadata)
Configure IQL query to match security events
  • IQL purpose
  • IQL uses
  • IQL syntax structures
  • Entity search and IQL search (simple search using “entity”, IQL and flow search, using regex in the search, SMTP search, using the IN and LIKE syntax, output with a global map, challenge, expert challenge)
Detection (15–25% of the exam)
Tasks Details
Analyze detections and behavioral observations
  • Detector with details
  • Severity levels
  • Confidence levels
  • Resolution options
  • Basic tools for scoping the impact of a detection
  • Behavioral observations
  • Observation details
  • Investigation stage
  • Use case: IOC investigation
Implement detectors
  • New detector
  • Run list
  • Tuning detections
Investigations and integrations (20–30% of the exam)
Tasks Details
Perform investigations to detect threats
  • Search settings
  • Describe gathering context
  • Open-source intelligence (OSINT)
  • VirusTotal
  • External entities
  • File hashes
  • Timeline usage
  • Steps for changing to a different tactic
  • Query modification
  • Packet capture
  • Resolution types
  • Detection resolution
  • Use cases: Investigate an outbreak alert, investigate a detection
Explain how to integrate FortiNDR Cloud (API/connectors)
  • FortiNDR: FortiNDR Cloud connector
  • FortiEDR: FortiEDR panel, detection investigating, host isolation
  • FortiNDR Cloud API: API functions
Perform threat hunting activities
  • Concepts and definitions
  • A practical model for conducting cyberthreat hunting
  • Tactics, Techniques, and Procedures (TTP)-based threat hunting
  • Fortinet-Gigamon Threat Hunting whitepaper
  • Ransomware
Training Resources

The following resources are recommended for attaining the knowledge and skills that are covered on the exam. The recommended training is available as a foundation for exam preparation. In addition to training, you are strongly encouraged to have hands-on experience with the exam topics and objectives.

  • FortiNDR Cloud 26 Analyst course and hands-on labs
  • FortiNDR Cloud 26—User Guide
Experience

A minimum of 6 months of practical experience with FortiNDR cloud administration, or equivalent technology, is recommended.

Exam Sample Questions

A set of sample questions is available from the Fortinet Training Institute. These questions represent the exam content in question type and content scope. However, the questions do not necessarily represent all the exam content, nor are they intended to assess your readiness to take the certification exam.

See the Fortinet Training Institute for the course that includes the sample questions

Examination Policies and Procedures

The Fortinet Training Institute recommends that you review the exam policies and procedures before you register for the exam. Access important information on the Fortinet Training Institute Policies page, and find answers to common questions on the FAQ page.

Questions?

If you have more questions about the NSE Certification Program, contact us through the Fortinet Training Institute Helpdesk page.

Data retention summary