FortiSIEM incidents can use status values that track the incident lifecycle, including active investigation, closure, clearing, and resolution. These statuses help analysts manage whether an incident is still open, has been cleared by conditions, has been closed, or has been resolved.