Exact Extract: “If there is more than one subpattern, you must specify the logic between the subpatterns and define the subpattern relationship and constraints.”

Exact Extract: “FortiSIEM also supports rules with multiple subpatterns… Subpattern X was FOLLOWED BY subpattern Y within the time window.”

Exact Extract: “This slide shows a multiple subpattern rule. The rule contains two subpatterns… with a FOLLOWED_BY operator… To ensure FortiSIEM is correlating the proper logs… [matching fields] must match. This is the relationship, also called a constraint, between the two subpatterns.”

The correct answers are C, D, and E. You need two subpatterns because the detection contains two different event patterns: repeated failed logins and a later successful login. You then need FOLLOWED_BY because the successful login must occur after the failed-login sequence, not merely within the same time range. Finally, you must define subpattern relationships and constraints, matching source IP address and user, so FortiSIEM does not correlate failed logins from one user or host with a successful login from a different user or host. A is wrong because failed-login and successful-login subpatterns normally require different filters and often different aggregate thresholds. B is not the best answer as written because the key requirement is the rule/subpattern relationship within the 15-minute correlation window, not simply assigning independent time windows to each subpattern.

Technical Deep Dive: The clean FortiSIEM logic is: failed-login subpattern with an aggregate such as COUNT(Matched Events) > = N, success-login subpattern with COUNT(Matched Events) > = 1, a FOLLOWED_BY operator, and constraints like FailedLogin Source IP = SuccessLogin Source IP and FailedLogin User = SuccessLogin User. The time window should represent 15 minutes, usually 900 seconds. This is correlation-engine behavior; FortiGate NP/CP hardware offload has no role because FortiSIEM is analyzing normalized log events, not accelerating packet forwarding.