My understanding of the general concepts is:
an event is a "message" from a reporting device. In your case, it's a syslog message from a solaris box.
a session is usually just a representation of an event. There's more to it than that, for example when NAT occurs the session may show the pre and post NAT information. Conceptually though, it's easier to just think of a session as a representation of an event and I use the terms interchangeably.
as events come in(or are retrieved), they are placed in event type buckets. this is generally called event normalization. This allows CSMARS to put messages that mean the same thing but are from different types of devices into the same event type. for example, a firewall deny message from either a checkpoint firewall or a cisco pix are put into the "Deny packet due to security policy" event type.
event types are further classified as being members of one or more event type groups. for example, the "Deny packet due to security policy" event type is part of the "FirewallPolicyViolation/ALL" event type group (as well as many others). the concept of an event type group is pretty critical. It is another layer of abstraction that allows the rules to remain somewhat static.
So, an "event type" is a collection of "events" and an "event type group" is a collection of "event types".
the default rules that ship with csmars are based entirely on event type groups (although you can add specific event types to rules).
And finally, incidents are the result of a rule firing.
If you want to verify that a reporting device is generating events in CSMARS, run an "all matching events" query for the specific device.
I don't use the topology graphs in csmars, so I have no idea how/if you can change the display.
