When configuring anomaly detection machine learning, in which step must you select the fields to...

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide’s anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference. Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.