NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Incident details can use event attributes selected as Group By attributes, which identify the grouped events that trigger an incident. The configured Group By fields include User and Reporting Device. Event Type is a filter condition, and COUNT(Matched Events) is the aggregation threshold rather than a grouped event attribute. Fortinet: Creating Rules