FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

Grouping by multiple attributes produces one result for each distinct combination of their values. Five distinct Reporting Device, Reporting IP, and Application Category combinations are present because the two DB events reported by FW01 at 10.1.1.1 belong to the same group. FortiSIEM documentation describes Group By attributes as the attributes used to group events before aggregation.