The Aggregate section in a FortiSIEM correlation rule is used to define the threshold conditions that must be met by a group of events before the rule is triggered. As shown in the exhibit, this section includes the Count(Matched Events) function, which allows an administrator to specify the minimum number of events that must match the filter criteria within a given time window to trigger the rule and its associated actions.

B. Group By: This section specifies the attributes (like Source IP or User) used to group related events together for aggregation, not the trigger count itself.

C. Actions: This section defines the response that FortiSIEM will take after a rule's conditions are met and it has been triggered, such as creating an incident.

D. Filters: This section defines the initial criteria for selecting individual events to be considered by the rule, not the aggregate count needed to trigger it.

1. FortiSIEM 7.1.0 Administration Guide

Page 468

"Step 4 - Define Rule Conditions": "In the Aggregate section

define the conditions that must be met by the group of events defined in the Group By settings. For example

you could set the condition that the count of matched events must be greater than 5..."

2. FortiSIEM 7.1.0 Concepts Guide

Page 100

"Rule Definition": "The Aggregate tab is where you define the threshold condition that must be met for the rule to trigger. For example

you can set the condition that the count of matched events must be greater than 5 within 1 minute."