Refer to the exhibit.

Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:

Analyzing theQuery Configurationexhibit in the context of FortiSIEM 7.3 search logic reveals several syntax and logical errors that prevent the query from returning results:

Logical Operator Error (E):The user intends to find traffic to EuropeORAsia. In the exhibit, the first row (Group: Europe) is followed by a defaultANDoperator. This forces the query to look for a single flow where the destination is simultaneously in Europe and Asia, which is logically impossible. It must be changed toOR.

Missing Parentheses (C):When combiningORandANDlogic in FortiSIEM, parentheses are required to define the order of operations. Without them, the query might evaluate "Asia AND Destination Country IS NOT null AND Source IP IN..." first. To correctly find (Europe OR Asia) that also matches the LAN segment, parentheses must group the first two rows.

Incorrect Operator for IP Range (D):The exhibit uses theINoperator for the value 10.0.0.0, 10.200.200.254. In FortiSIEM, theINoperator is used for a comma-separated list of specific values or CMDB groups. To specify a continuous range of IP addresses (the "LAN segment"), theBETWEENoperator must be used.

Why other options are incorrect:

IS NOT null (A):In FortiSIEM, "IS NOT null" is a valid operator/value combination used to ensure a specific attribute has been successfully parsed and populated in the event record.

Time Range (B):There is no requirement for a time range to be "Absolute" when using CMDB groups; "Relative" time ranges (like the "Last 30 Days" shown) are commonly used and fully supported for such queries.

SOC Concepts and Frameworks