Refer to the exhibit.

The FortiSIEM administrator is examining events for two devices to investigate an issue However, the administrator is not getting any results from their search.
Based on the selected fillers shown in the exhibit, why is the search returning no results?

Which two FortiSIEM components work together to provide real-time event correlation?

Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

What are the four categories of incidents?

Refer to the exhibit.

A FortiSlEM administrator wants to group some attributes for a report, but is not able to do so successfully.
As shown in the exhibit, why are some of the fields highlighted in red?