Technical Tip: Incident Details Not Populating in FortiSIEM

[calvinc97]

Description	This article describes how to resolve Incident Details Not Populating in FortiSIEM.
Scope	FortiSIEM.
Solution	Some incidents may show a blank details pane even though related raw events are available and can be searched from Analytics. Incidents with detail: Incidents with no detail: Example: Incident triggered by PH_RULE_TO_FORTIGUARD_MALWARE_IP_Mizuho events does not display any incident details. The incident detail pane is populated using: Triggered Attributes: Event fields selected in the Incident Rule configuration. Parser Output: Data parsed from the raw event and stored as attributes. If none of the selected Triggered Attributes in the rule are populated by the parser for a particular event type, the incident pane will appear empty. Workaround: Add a populated attribute (Details) to the rule’s Triggered Attributes list: Navigate to Resources -> Rules. Edit the rule associated with the affected incident. Under Triggered Attributes, add Details (or any other populated attribute such as Message or Event Description). Save and apply the rule. Re-run the rule on historical data or wait for a new incident of the same type. Open the incident details pane, and the relevant event information should now be displayed.