Report queries and permissions must maintain explicit tenant isolation across template reuse. That principle matters when a customer report unexpectedly contains data from another ADOM following a copy-and-paste template operation. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer SQL datasets can group log rows into report-ready measured categories.

FortiAnalyzer datasets require compatible device log types and valid projected field mappings. That principle matters when a report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer SQL datasets can group log rows into report-ready measured categories.

Report output profiles control delivery channels and recipients separately from SQL content. That principle matters when a report is generated correctly but emailed to an outdated distribution list that includes a former contractor. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer SQL datasets can group log rows into report-ready measured categories.

The impact report states distinct asset count separately from number of incidents and alerts. That outcome would be relevant when Several alert events are grouped into one incident, and analysts use the incident count as the number of distinct infected endpoints. The decisive evidence is: An appropriate test burst is consolidated while separate users remain distinguishable.

The indicator inventory identifies one canonical domain value with correct affected incidents. That outcome would be relevant when an analyst creates two indicators for the same domain with different case and trailing-dot spelling and counts them as two distinct threat actors. The decisive evidence is: An appropriate test burst is consolidated while separate users remain distinguishable.

A test alert identifies the actual affected device and the intended incident-response owner. That outcome would be relevant when a threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. The decisive evidence is: An appropriate test burst is consolidated while separate users remain distinguishable.

The chart renders accurate labels and values without unknown-field or missing-column errors. That outcome would be relevant when a custom dataset returns several columns, but the chart expects a value field that the query never exposes. The decisive evidence is: The final report fits its accepted delivery limit while retaining all required audit findings.

The report jobs complete within their scheduled windows while log ingestion remains healthy. That outcome would be relevant when Two report jobs run concurrently against the same large dataset and saturate the analytics system during peak business hours. The decisive evidence is: The final report fits its accepted delivery limit while retaining all required audit findings.

A controlled blocked-IPS sample contributes to the chart while unrelated permitted traffic does not. That outcome would be relevant when a security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. The decisive evidence is: The final report fits its accepted delivery limit while retaining all required audit findings.

The query returns expected rows and the chart renders after the schema-compatible change. That outcome would be relevant when a report chart fails with an invalid SQL column after the dataset was modified for a new parser release. The decisive evidence is: The chart preview shows the expected values and is available for insertion into the report.

The final-hour events appear within the corrected intended interval and no evidence is fabricated. That outcome would be relevant when an auditor complains that a report omits the final hour of a reporting day, and administrators assume the missing log records were deleted. The decisive evidence is: The chart preview shows the expected values and is available for insertion into the report.

A controlled blocked-IPS sample contributes to the chart while unrelated permitted traffic does not. That outcome would be relevant when a security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. The decisive evidence is: The chart preview shows the expected values and is available for insertion into the report.

FortiAnalyzer charts reference datasets that query the SQL Analytics database. That principle matters when an analyst creates a custom chart without first defining a dataset for its source fields. It is not the mechanism explaining the selected response to the present facts. SQL dataset execution cost depends on filters, joins and grouping in the Analytics database.

FortiAnalyzer report configuration and scheduler operation are distinct from layout design. That principle matters when a security officer requests a weekly report, but the administrator creates a correct report definition and never schedules it. It is not the mechanism explaining the selected response to the present facts. SQL dataset execution cost depends on filters, joins and grouping in the Analytics database.

Report datasets are executable SQL queries that depend on the available log schema. That principle matters when a report chart fails with an invalid SQL column after the dataset was modified for a new parser release. It is not the mechanism explaining the selected response to the present facts. SQL dataset execution cost depends on filters, joins and grouping in the Analytics database.

Applying internet reputation semantics to private IPs can yield unusable or misleading threat scores. Such a failure could arise when a threat analyst creates an IP indicator using a private RFC1918 address and expects external reputation enrichment to score it globally. Here the stated problem is specifically: A playbook retrieves an indicator but the next task uses a hardcoded demo IP instead of the trigger's variable. Its direct exposure is: Hardcoded values can send response commands to unrelated or stale systems.

Case count can undercount or overcount affected systems when event grouping differs. Such a failure could arise when Several alert events are grouped into one incident, and analysts use the incident count as the number of distinct infected endpoints. Here the stated problem is specifically: A playbook retrieves an indicator but the next task uses a hardcoded demo IP instead of the trigger's variable. Its direct exposure is: Hardcoded values can send response commands to unrelated or stale systems.

Local task completion can be mistaken for end-to-end mitigation success. Such a failure could arise when an automated response reports a successful FortiAnalyzer task but the target FortiGate still allows the suspicious IP. Here the stated problem is specifically: A playbook retrieves an indicator but the next task uses a hardcoded demo IP instead of the trigger's variable. Its direct exposure is: Hardcoded values can send response commands to unrelated or stale systems.

Archive and Analytics represent different phases of FortiAnalyzer's log storage and query workflow. That principle matters when a customer retains compressed Archive logs for a year but tries to run a report against that full year when Analytics retention is shorter. It is not the mechanism explaining the selected response to the present facts. Connector health, playbook execution and external remediation success are different SOC control signals.

FortiAnalyzer receives real-time files before inserting and indexing eligible Analytics data in its SQL database. That principle matters when a newly received FortiGate log appears in raw form but has not yet appeared in a SQL-driven analytics report. It is not the mechanism explaining the selected response to the present facts. Connector health, playbook execution and external remediation success are different SOC control signals.

Incident charts and tables apply state and time filters to the visible event population. That principle matters when a SOC dashboard displays an incident count of zero because a saved filter restricts the table to closed incidents only. It is not the mechanism explaining the selected response to the present facts. Connector health, playbook execution and external remediation success are different SOC control signals.

Grouping on a shared translated address can convert unrelated activity into a false coordinated attack. Such a failure could arise when an event handler uses a source IP grouping key, but all translated clients appear as a single NAT gateway. Here the stated problem is specifically: An event handler treats any web filter deny as an incident, including expected business-policy blocks. Its direct exposure is: Treating every blocked connection as a compromise creates widespread false incidents.

Free-text notes alone may not support indicator-specific searches or enrichment workflows. Such a failure could arise when a newly discovered malicious URL is entered only as a note in an incident rather than a typed indicator. Here the stated problem is specifically: An event handler treats any web filter deny as an incident, including expected business-policy blocks. Its direct exposure is: Treating every blocked connection as a compromise creates widespread false incidents.

A started enrichment task is not the same as persisted validated intelligence. Such a failure could arise when an analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. Here the stated problem is specifically: An event handler treats any web filter deny as an incident, including expected business-policy blocks. Its direct exposure is: Treating every blocked connection as a compromise creates widespread false incidents.

Unlogged response parameters can make automated changes impossible to reverse safely. Such a failure could arise when a response engineer wants to roll back a failed containment action but the playbook has no record of which firewall or indicator was changed. Here the stated problem is specifically: A playbook performs IP containment but the FortiOS connector lists no matching FortiGate action and no enabled Incoming Webhook automation rule exists on that firewall. Its direct exposure is: FortiAnalyzer cannot invent FortiGate actions that have not been configured on the target firewall.

A syntactically valid rule in the wrong ADOM cannot see intended tenant log records. Such a failure could arise when an analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. Here the stated problem is specifically: A playbook performs IP containment but the FortiOS connector lists no matching FortiGate action and no enabled Incoming Webhook automation rule exists on that firewall. Its direct exposure is: FortiAnalyzer cannot invent FortiGate actions that have not been configured on the target firewall.

Success of one local task does not imply the entire multi-step response ran to completion. Such a failure could arise when a playbook writes an incident note successfully but the team assumes all following connector calls must also have succeeded. Here the stated problem is specifically: A playbook performs IP containment but the FortiOS connector lists no matching FortiGate action and no enabled Incoming Webhook automation rule exists on that firewall. Its direct exposure is: FortiAnalyzer cannot invent FortiGate actions that have not been configured on the target firewall.

Excessive field selection can cause unnecessary personal or security information disclosure. Such a failure could arise when a junior analyst builds a custom report with confidential usernames in every chart although the audience requires only totals. Here the stated problem is specifically: An analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. Its direct exposure is: Mismatched report attachments weaken incident evidence and may leak unrelated device details.

Screenshots do not preserve query logic, chart bindings or runtime report configuration. Such a failure could arise when a custom report must be reused after FortiAnalyzer replacement, but the team exports only a screenshot of its layout. Here the stated problem is specifically: An analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. Its direct exposure is: Mismatched report attachments weaken incident evidence and may leak unrelated device details.

Mixed query windows can make individually valid report elements contradict one another. Such a failure could arise when a report has separate numeric charts and a text macro sourced from different time intervals, leading to conflicting values. Here the stated problem is specifically: An analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. Its direct exposure is: Mismatched report attachments weaken incident evidence and may leak unrelated device details.

Test the revised handler on future events and explicitly review earlier incidents using approved procedures. That action applies when an operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. It does not resolve the current source condition: An incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. The relevant correction is: Inspect associated indicators and actual response actions for each affected asset separately.

Review indicator relationships and coordinate case ownership before executing response actions. That action applies when Two analysts investigate the same phishing indicator in different incidents and independently attempt host containment. It does not resolve the current source condition: An incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. The relevant correction is: Inspect associated indicators and actual response actions for each affected asset separately.

Include appropriate available device and source metadata in handler messages and notification context. That action applies when a threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. It does not resolve the current source condition: An incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. The relevant correction is: Inspect associated indicators and actual response actions for each affected asset separately.