An administrator wants to search for events received from Linux and Windows agents.

 Search Filters in FortiSIEM: When searching for specific events, administrators can use various attributes to filter the results.

 Attribute for Agent Events: To view events received specifically from Linux and Windows agents, the attributeExternal Event Receive Agentsshould be used.

Function: This attribute filters events that are received from agents, distinguishing them from events received through other protocols or sources.

 Search Efficiency: Using this attribute helps the administrator focus on events collected by FortiSIEM agents, making the search results more relevant and targeted.

 References: FortiSIEM 6.3 User Guide, Event Search and Filters section, which describes the available attributes and their usage for filtering search results.