Incident Categories in FortiSIEM: Incidents in FortiSIEM are categorized to help administrators quickly identify and prioritize the type of issue.
Four Main Categories:
* Performance: Incidents related to the performance of devices and applications, such as high CPU usage or memory utilization.
* Availability: Incidents affecting the availability of services or devices, such as downtime or connectivity issues.
* Security: Incidents related to security events, such as failed login attempts, malware detection, or unauthorized access.
* Change: Incidents triggered by changes in the configuration or state of devices, such as new software installations or configuration modifications.
Importance of Categorization: These categories help in the efficient management and response to different types of incidents, allowing for better resource allocation and quicker resolution.
References: FortiSIEM 6.3 User Guide, Incident Management section, which details the different categories of incidents and their significance.