When you point a FortiGate device like this 90D shown here to the NetWatcher sensor for correlation you have to use the IP address versus the local DNS name as the IPS functionality will not allow the local DNS name to resolve.
Also note that you want to ensure all the right check boxes are selected as you see in the figure below.
Once the device is added to your customer portal you can attempt a failed login to the firewall with a bad password.
You will first see the event appear under System Events the FortiGate user interface as below:
and then shortly thereafter you will see it in the customer portal advanced tab or the MSP Portal events tab as you see here: