Is this only for FortiGate?
The focus is FortiGate, but the same optimization model can be applied to Wazuh and generic syslog sources.
Technical Guide
FortiGate SIEM optimization
FortiGate SIEM optimization is less about storing raw logs and more about field normalization, scenario correlation, risk-based prioritization, and false-positive reduction.
Optimization model
When source IP, destination IP, policy ID, VPN user, action, service, and device identity use one schema, SIEM queries become faster and more consistent.
Alert quality
Using session behavior, asset importance, and last-seen context instead of simple thresholds lets analysts review only meaningful incidents.