 Grouping Attributes in Reports: When creating reports in FortiSIEM, certain attributes can be

grouped to summarize and organize the data.

 Unique Attributes: Attributes that are unique for each event cannot be grouped because they do

not provide a meaningful aggregation or summary.

 Red Highlighting Explanation: The red highlighting in the exhibit indicates attributes that cannot be

grouped together due to their unique nature. These unique attributes include Event Receive Time,

Reporting IP, Event Type, Raw Event Log, and COUNT(Matched Events).

 Attribute Characteristics:

Event Receive Time is unique for each event.

Reporting IP and Event Type can vary greatly, making grouping them impractical in this context.

Raw Event Log represents the unprocessed log data, which is also unique.

COUNT(Matched Events) is a calculated field, not suitable for grouping.

 Reference: FortiSIEM 6.3 User Guide, Reporting section, explains the constraints on grouping

attributes in reports.