WMI Method: Windows Management Instrumentation (WMI) is a set of specifications from Microsoft for consolidating the management of devices and applications in a network.
Log Collection: WMI is used to collect various types of logs from Windows devices.
* Security Logs: Contains records of security-related events such as login attempts and resource access.
* Application Logs: Contains logs generated by applications running on the system.
* System Logs: Contains logs related to the operating system and its components.
Comprehensive Data Collection: By using WMI, FortiSIEM can gather a wide range of event logs that are crucial for monitoring and analyzing the security and performance of Windows devices.
References: FortiSIEM 6.3 User Guide, Data Collection Methods section, which details the use of WMI for collecting event logs from Windows devices.

Discovery Scan Types: FortiSIEM uses various scan types to discover devices on a network.
Layer 2 (L2) Scan: An L2 scan discovers devices based on ARP tables and MAC address information from adjacent devices.
* Limitation: If a device is quiet (not actively communicating) and its entry is not present in the ARP table of adjacent devices, the L2 scan may miss it.
Other Scan Types:
* CMDB Scan: Based on the existing Configuration Management Database (CMDB) entries.
* Range Scan: Scans a specified IP range for devices.
* Smart Scan: Uses a combination of methods to discover devices.
References: FortiSIEM 6.3 User Guide, Device Discovery section, which explains the different types of discovery scans and their characteristics.

Grouping Events in FortiSIEM: Grouping events by specific attributes allows for the aggregation of similar events, providing clearer insights and reducing clutter.
Grouping Criteria: For this question, events are grouped by "User," "Source IP," and "Application Category." Unique Combinations Analysis:
* Ryan, 1.1.1.1, Web App(appears multiple times but is one unique combination)
* John, 5.5.5.5, DB
* Paul, 3.3.2.1, Web App
* Ryan, 1.1.1.15, DB
* Wendy, 1.1.1.6, DB
Result Calculation: There are five unique combinations in the provided data based on the specified grouping attributes.
References: FortiSIEM 6.3 User Guide, Event Management and Reporting sections, which explain how to group events by various attributes for analysis and reporting purposes.