In FortiSIEM Analytics, “Group-By” returns one output row for every unique combination of the selected fields.

When the query groups on both User and Count, the system inspects the result-set and builds pairs (User, Count).

The dataset shown in the exhibit contains five distinct pairs, so the Group-By operation produces five rows. 1-to-1 correspondence between each unique (User, Count) pair and an output row yields exactly five displayed results.

A. Two – only possible if there were exactly two distinct (User, Count) pairs; the exhibit shows more.

B. Six – would require six unique (User, Count) pairs; only five exist.

C. Three – contradicted by the five distinct pairs visible in the data.

E. One – would mean all rows shared the same User and Count values, which is not the case.

1. Fortinet

“FortiSIEM 7.2 Administration Guide”

Section 4 ‘Analytics – Group By and Aggregate’

p. 216-218 – explains that each unique combination of selected fields is returned as one result row.

2. Fortinet

“FortiSIEM 7.2 User Guide”

Chapter 3 ‘Using the Analytics Tab’

subsection ‘Group By Pane’

p. 112 – details behaviour when multiple attributes (e.g.

User and Count) are chosen for grouping.

3. Fortinet

“FortiSIEM 7.2 Query Basics Quick Reference”

Table 2

p. 6 – clarifies that grouping on two fields creates N results where N = number of distinct value pairs.