Which two types of information can FortiSIEM retrieve from FortiClient EMS through an external connection? (Choose two.)

Refer to the exhibit.

FortiSIEM is receiving syslog events from a firewall.
You are trying to search raw event logs for traffic from the last two hours that contain the keyword
"UDP". However, you are getting no results from the search.
Based on the filter shown in the exhibit, why are you getting no search results?

Several new internal servers are generating incidents and must be excluded from several FortiSIEM rules. How must you tune rules to exclude several undiscovered devices from rules?

What are the four incident status values on FortiSIEM?

Which two categories can you map to the MITRE ATT&CK coverage tables on FortiSIEM?
(Choose two.)