Expression Builder in FortiSIEM: The Expression Builder is used to create expressions for analyzing event data.
Correct Syntax: The correct syntax for counting matched events isCOUNT(Matched Events).
* Function:COUNTis a function that takes a parameter, in this case, "Matched Events," to count the number of occurrences.
Common Errors: Incorrect syntax, such as reversing the order or using parentheses improperly, can lead to invalid expressions.
References: FortiSIEM 6.3 User Guide, Expression Builder section, which explains the correct syntax and usage for creating valid expressions for event analysis.

Raw Log Data: When devices send logs to FortiSIEM, the data arrives in a raw, unstructured format.
Data Parsing Process: The process that converts this raw log data into a structured format is known as data parsing.
* Data Parsing: This involves extracting relevant fields from the raw log entries and organizing them into
* a structured format, making the data usable for analysis, reporting, and correlation.
Significance of Structured Data: Structured data is essential for effective event correlation, alerting, and generating meaningful reports.
References: FortiSIEM 6.3 User Guide, Data Parsing section, which details how raw log data is transformed into structured data through parsing.

Device Discovery Information: Information about discovered devices, including their configurations and statuses, is stored in a specific database.
CMDB: The Configuration Management Database (CMDB) is used to store detailed information about the devices discovered by FortiSIEM.
* Function: It maintains comprehensive details about device configurations, relationships, and other metadata essential for managing the IT infrastructure.
Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a centralized repository of device information, facilitating efficient management and monitoring.
References: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which details the storage and usage of device discovery information.