What happens to UEBA events when a user is off-net?

A When a User and Entity Behavior Analytics (UEBA) agent is off-net, meaning it is disconnected from the network and cannot reach the FortiSIEM collector, it temporarily stores (caches) events locally until it can re-establish a connection. ● This caching mechanism prevents data loss by ensuring events are retained even when the agent is offline. ● Once the connection to the FortiSIEM collector is restored, the agent uploads the cached events. ● This ensures continuity in user behavior monitoring, even when users are disconnected.