I'm assuming from your description that fortimail/fortiweb is sending syslog messages to SEM.
Do you see them in checklogs on the SEM?
If you do, assuming the connector is enabled and reading from the same location, are you seeing unmatched data events in nDepth?