NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

The outer event query searches the last 10 minutes, while the nested query evaluates the Approved Devices report over the last 30 days. The NOT IN condition therefore returns source IP addresses present in the last 10 minutes of events that are absent from the Approved Devices report for that 30-day nested range.