Technical Tip: Missing Raw Event Logs in Incident Tab

[rmehta]

Description	This article describes how to diagnose and resolve Missing Raw Event Logs in the Incident Tab.
Scope	FortiSIEM.
Solution	If raw event logs are not visible in the Incident tab of FortiSIEM, follow these steps to troubleshoot the issue. Validate Data Collection: Verify that the device is properly set up and sending logs. Confirm Log Sources: Ensure the device is active and correctly integrated into FortiSIEM. Examine the Raw Event Tab: Investigate this section for logs, considering any filters affecting the Incident view. Audit Data Retention: Check the retention configurations and available storage space. Verify Parsing: Ensure that FortiSIEM can interpret the log format of the device. If logs are missing due to parsing challenges, validate the accuracy of FortiSIEM's parsing rules for the specific device or application. Review Permissions: Ensure the user role has access to raw logs. Review User Permissions: Confirm that the user role includes access to raw logs. Evaluate Incident Filters: Double-check filters or policies that could restrict log visibility. Monitor Collectors: Verify the functionality of collectors and workers. Perform a System Health Assessment: Look for any system errors impacting log ingestion processes.