Refer to the exhibit. A FortiSIEM administrator wants to group some attributes for a report, but is not able to do so successfully. As shown in the exhibit, why are some of the fields highlighted in…

Question

Exhibits

Options

• AUnique attributes cannot be grouped.
• BThe Event Receive Time attribute is not available for logs.
• CThe attribute COUNT(Matched events) is an invalid expression.
• DNo RAW Event Log attribute is available for devices.

• A
  74% (17)
• B
  9% (2)
• C
  4% (1)
• D
  13% (3)

Explanation

Grouping Attributes in Reports: When creating reports in FortiSIEM, certain attributes can be grouped to summarize and organize the data. Unique Attributes: Attributes that are unique for each event cannot be grouped because they do not provide a meaningful aggregation or summary. Red Highlighting Reference: The red highlighting in the exhibit indicates attributes that cannot be grouped together due to their unique nature. These unique attributes include Event Receive Time, Reporting IP, Event Type, Raw Event Log, and COUNT(Matched Events). Attribute Characteristics: Event Receive Time is unique for each event. Reporting IP and Event Type can vary greatly, making grouping them impractical in this context. Raw Event Log represents the unprocessed log data, which is also unique. COUNT(Matched Events) is a calculated field, not suitable for grouping.

No community discussion yet for this question.