* Grouping Attributes in Reports: When creating reports in FortiSIEM, certain attributes can be grouped to summarize and organize the data.
* Unique Attributes: Attributes that are unique for each event cannot be grouped because they do not provide a meaningful aggregation or summary.
* Red Highlighting Explanation: The red highlighting in the exhibit indicates attributes that cannot be grouped together due to their unique nature. These unique attributes include Event Receive Time, Reporting IP, Event Type, Raw Event Log, and COUNT(Matched Events).
* Attribute Characteristics:
Event Receive Time is unique for each event.
Reporting IP and Event Type can vary greatly, making grouping them impractical in this context.
Raw Event Log represents the unprocessed log data, which is also unique.
COUNT(Matched Events) is a calculated field, not suitable for grouping.
* Reference: FortiSIEM 6.3 User Guide, Reporting section, explains the constraints on grouping attributes in reports.

* Device Status in FortiSIEM: FortiSIEM assigns different statuses to devices based on their operational state and performance metrics.
* Packet Loss Impact: The reported packet loss percentage directly influences the status assigned to a device. Packet loss between 50% and 98% indicates significant network issues that affect the device's performance.
* Degraded Status: When packet loss is between 50% and 98%, FortiSIEM assigns a "Degraded" status to the device. This status indicates that the device is experiencing substantial packet loss, which impairs its performance but does not render it completely non-functional.
* Reasoning: The "Degraded" status helps administrators identify devices with serious performance issues that need attention but are not entirely down.
* Reference: FortiSIEM 6.3 User Guide, Device Availability and Status section, explains the criteria for assigning different statuses based on performance metrics such as packet loss.

* Anomaly Baseline Data: Anomaly baseline data refers to the statistical profiles and baselines calculated for various parameters to detect deviations indicative of potential security incidents.
* Profile DB: The Profile DB is specifically designed to store such baseline data in FortiSIEM.
Purpose: It maintains statistical profiles for different monitored parameters to facilitate anomaly detection.
Usage: This data is used by FortiSIEM to compare real-time metrics against the established baselines to identify anomalies.
* Reference: FortiSIEM 6.3 User Guide, Database Architecture section, which describes the different databases used in FortiSIEM and their purposes, including the Profile DB for storing anomaly baseline data.

Syslog Ports: Syslog messages can be sent over different ports using TCP or UDP protocols.
Common Ports for Syslog:
* UDP 514: This is the default port for sending syslog messages over UDP.
* TCP 514: This is the default port for sending syslog messages over TCP, providing a more reliable transmission.
* TCP 1470: This port is often used for secure or alternative syslog transmission.
Usage in FortiSIEM: FortiSIEM can be configured to receive syslog messages on these ports to ensure the logs are collected from various network devices.
References: FortiSIEM 6.3 User Guide, Syslog Integration section, which details the supported ports for syslog transmission.

* Anomaly Data Storage: Anomaly data, including running averages and standard deviation values for different parameters such as traffic and device resource usage, is stored in a specific database.
* Profile DB: The Profile DB is used to store this type of anomaly data.
Function: It maintains statistical profiles and baselines for monitored parameters, which are used to detect anomalies and deviations from normal behavior.
* Significance: Storing anomaly data in the Profile DB allows FortiSIEM to perform advanced analytics and alerting based on deviations from established baselines.
* Reference: FortiSIEM 6.3 User Guide, Database Architecture section, which describes the purpose and contents of the Profile DB in storing anomaly and baseline data.