Hello,
I'm trying to retrieve events from FortiSIEM using the API endpoint "phoenix/rest/query/eventQuery" .I'm sending the following XML payload in the POST request:
<?xml version="1.0" encoding="UTF-8"?>
<Reports>
<Report baseline="" rsSync="">
<Name>Top FortiSIEM Events By Count</Name>
<Description>Ranks the events by the number of times they have occurred in a given time period.</Description>
<SelectClause>
<AttrList>eventType,COUNT(*)</AttrList>
</SelectClause>
<OrderByClause>
</OrderByClause>
</Report>
</Reports>
The query is created and finished successfully. However, when I call the follow-up API GET "phoenix/rest/query/events/10412,1753450073522/0/1000", I receive a response with no events, even though I can see the relevant logs in the FortiSIEM console under the Analytics view.
Could you please help me understand why the API returns no events?
