 Event Type Population: In FortiSIEM, the Event Type field is populated based on specific identifiers within the raw message or event log.

 Raw Message Analysis: The exhibit shows a raw message with various components, includingPH_DEV_MON_SYS_DISK_UTIL,PHL_INFO,phPerfJob, anddiskUtil.

 Primary Event Identifier: ThePH_DEV_MON_SYS_DISK_UTILat the beginning of the raw message is the primary identifier for the event type. It categorizes the type of event, in this case, a system disk utilization monitoring event.

 Event Type Field: FortiSIEM uses this primary identifier to populate the Event Type field, providing a clear categorization of the event.

 References: FortiSIEM 6.3 User Guide, Event Processing and Event Types section, details how event types are identified and populated in the system.

 Incident Status in FortiSIEM: The status of an incident indicates its current state and helps administrators track and manage incidents effectively.

 Cleared Status: When an incident’s status is "Cleared," it means that a specific condition set to clear the incident has been satisfied.

Clear Condition: This is typically a predefined condition that indicates the issue causing the incident has been resolved or no longer exists.

 Automatic vs. Manual Clearance: While some incidents may be cleared automatically based on clear conditions, others might be manually cleared by an operator.

 References: FortiSIEM 6.3 User Guide, Incident Management section, detailing the various incident statuses and the conditions that lead to an incident being marked as "Cleared."

 Raw Log Data: When devices send logs to FortiSIEM, the data arrives in a raw, unstructured format.

 Data Parsing Process: The process that converts this raw log data into a structured format is known as data parsing.

Data Parsing: This involves extracting relevant fields from the raw log entries and organizing them into a structured format, making the data usable for analysis, reporting, and correlation.

 Significance of Structured Data: Structured data is essential for effective event correlation, alerting, and generating meaningful reports.

 References: FortiSIEM 6.3 User Guide, Data Parsing section, which details how raw log data is transformed into structured data through parsing.