Unfortunately, QRadar does not have a method to force lowercase when the event data is being processed/parsed by the DSM. Have you tried to use AQL and added LOWER to your advanced search? As AQL when it returns search results can force values to LOWER when you run a search in AQL.
For example:
Select
LOWER(username)
LOWER(LOGSOURCENAME(logsourceid))
FROM events
The other common method that users might take to resolve this type of issue would be to use an AQL Custom Function, which can do lots of fancy things like remote calls, data conversion, and advanced mathematical functions. Unfortunately, the Username field is a normalized property and not a Custom Event Property. AQL Custom Functions are only available for custom properties, not for standardized fields like Username.
You might need to see if there is a method to disable this on the FortiOS side of things or confirm if this a case-sensitive enable/disable would resolve the issue: https://kb.fortinet.com/kb/documentLink.do?externalID=FD38692
There is no tool for this that I'm aware of and you might need to try the AQL I listed to see if that helps.
#QRadar#Support#SupportMigration