SIEM & UEBA

Dear All,

I am using FortiSIEM 5.3.1, i notice some issue when click on Event tab, it suppose to show the details regarding the alert like raw log but i keep getting No data. Any idea why?

Hi Muhammad,

This is under the Incident Tab / select and Incident / Events ... obviously it should be showing data.

Can you do some basic checks from the CLI as root user:

phstatus

--all processes should be up. Make sure your SSH console screen if full screen.

dh -h

-- make sure you have disk space -the /data drive if using the native event database should not be 100% as the system should manage the storage.

top

-- check the load is not too high.. anything <4 should be ok.

How old is the Incident and what is the Rule?

Do you see other event data from that same time period if you run an analytical search?

Thanks

Dan

Dear All,

I am using FortiSIEM 5.3.1, i notice some issue when click on Event tab, it suppose to show the details regarding the alert like raw log but i keep getting No data. Any idea why?