Where are most of the security events logged?

While some systems might have a dedicated "Security log" for certain application-specific security events, the general and pervasive system-level security events are often integrated into the broader Event log category.

A Forward Traffic log details network traffic allowed or denied by security policies, not internal system security events like logins or configuration changes.

In many systems, including FortiGates, the 'Event log' (or 'System Events') is where core system-level security events, such as administrator logins, configuration changes, or critical service status changes, are recorded.

An Alert log typically contains only events deemed critical enough to generate an alert, not the comprehensive logging of all security events.

An Alert Monitoring Console is an interface to view alerts, not a log storage location itself.