When grouped by Reporting IP, Event Type, and User, FortiSIEM consolidates rows sharing the same values for these attributes.
Reporting IP: all are 10.1.1.1
Event Type: all are Logon
Users: Mike, Bob, and Alice
Thus, FortiSIEM will display three results, one for each user.

FortiSIEM parsers map raw event attributes to normalized event type attributes. In this event, the parser identifies the sysUpTime value and stores it under the normalized FortiSIEM attribute name PH_DEV_MON_SYS_UPTIME.

The search filters for Event Type values in the Logon Failure group and matches Destination IP addresses against the Device IP values returned from the Server Inventory CMDB report. This displays failed login events involving servers contained in the Server Inventory CMDB report.

FortiSIEM stores discovery information - such as device attributes, IPs, roles, and relationships - in the Configuration Management Database (CMDB). The CMDB maintains an up-to-date inventory of all discovered assets, serving as the central repository for device and infrastructure configuration data.