Choose supported product log sources or normalized common fields and create separate charts when necessary. That action applies when a report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. It does not resolve the current source condition: A report takes too long to render because a custom dataset performs an unrestricted join across high-volume traffic and IPS tables. The relevant correction is: Profile and narrow the SQL dataset by intended log type, join keys, source devices and time range.

Broaden and correctly group the intended action categories while retaining explicit source and time scope. That action applies when an auditor wants a comparison of allowed and blocked connections, but a custom dataset uses a filter that excludes denied actions. It does not resolve the current source condition: A report takes too long to render because a custom dataset performs an unrestricted join across high-volume traffic and IPS tables. The relevant correction is: Profile and narrow the SQL dataset by intended log type, join keys, source devices and time range.

Check whether required historical data was purged from SQL and whether recovery is possible from retained archives. That action applies when a report generation error began immediately after an administrator shortened the ADOM Analytics retention period. It does not resolve the current source condition: A report takes too long to render because a custom dataset performs an unrestricted join across high-volume traffic and IPS tables. The relevant correction is: Profile and narrow the SQL dataset by intended log type, join keys, source devices and time range.

The investigation separates reputation indicators from concrete device log events supporting the case. That outcome would be relevant when a SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. The decisive evidence is: The same record becomes searchable in Analytics after database processing completes without changing its raw fields.

Fresh logs identify the replacement hardware while the historical device remains distinguishable. That outcome would be relevant when After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. The decisive evidence is: The same record becomes searchable in Analytics after database processing completes without changing its raw fields.

Both simple and complex test messages preserve full usernames and relevant source identifiers. That outcome would be relevant when a newly customized parser matches a harmless log sample but fails on messages containing quoted spaces in usernames. The decisive evidence is: The same record becomes searchable in Analytics after database processing completes without changing its raw fields.

Traffic log metrics are investigative indicators whose security meaning depends on workload and destination. That principle matters when a log search for outbound exfiltration highlights a large transfer but the destination is an approved backup endpoint. It is not the mechanism explaining the selected response to the present facts. Session count, byte totals and throughput measure different aspects of monitored traffic.

FortiAnalyzer geographic aggregation is contextual intelligence, not automatic policy authorization. That principle matters when a FortiGate traffic record shows a country-based destination, and a team blocks all IPs in that country based on one event. It is not the mechanism explaining the selected response to the present facts. Session count, byte totals and throughput measure different aspects of monitored traffic.

FortiView aggregation granularity changes which short-duration anomalies remain visible. That principle matters when a dashboard uses daily averages and hides a ten-minute spike in outbound sessions during an incident. It is not the mechanism explaining the selected response to the present facts. Session count, byte totals and throughput measure different aspects of monitored traffic.

New log records arrive after the route and policy correction while unrelated inbound access stays blocked. That outcome would be relevant when a site sends encrypted Fortinet log traffic through a firewall that allows HTTPS management but blocks the configured log transport. The decisive evidence is: Missing-window logs appear after transport restoration where supported and their event times remain accurate.

One query returns meaningful comparable fields from supported gateway and FortiGate record examples. That outcome would be relevant when an MSSP imports logs from a third-party web gateway but relies on Fortinet-only field names without normalized equivalents. The decisive evidence is: Missing-window logs appear after transport restoration where supported and their event times remain accurate.

The incident count change is explained by actual new events or by the changed query window. That outcome would be relevant when an incident dashboard changes from High to Critical counts after an analyst widens the global time filter, and the team calls it a new outbreak. The decisive evidence is: Missing-window logs appear after transport restoration where supported and their event times remain accurate.

Choose supported product log sources or normalized common fields and create separate charts when necessary. That action applies when a report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. It does not resolve the current source condition: A custom dataset returns several columns, but the chart expects a value field that the query never exposes. The relevant correction is: Align SQL aliases and projected columns with the chart's configured category and metric data bindings.

Export the supported report and dependent charts or datasets through their relevant product workflows. That action applies when a custom report must be reused after FortiAnalyzer replacement, but the team exports only a screenshot of its layout. It does not resolve the current source condition: A custom dataset returns several columns, but the chart expects a value field that the query never exposes. The relevant correction is: Align SQL aliases and projected columns with the chart's configured category and metric data bindings.

Review report layout, chart references and the actual scheduled job configuration before regenerating. That action applies when an analyst edits a report's dataset yet the report continues using an old template revision in the scheduled output. It does not resolve the current source condition: A custom dataset returns several columns, but the chart expects a value field that the query never exposes. The relevant correction is: Align SQL aliases and projected columns with the chart's configured category and metric data bindings.

Test parser matching against varied representative event formats including quoted and optional fields. That action applies when a newly customized parser matches a harmless log sample but fails on messages containing quoted spaces in usernames. It does not resolve the current source condition: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. The relevant correction is: Set feasible Analytics and Archive retention policies based on approved storage capacity and reporting needs.

Use relevant SOC and FortiView threat widgets scoped to the full permitted Fabric and time interval. That action applies when a security team wants to recognize a regional attack spike but looks only at one device's interface traffic totals. It does not resolve the current source condition: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. The relevant correction is: Set feasible Analytics and Archive retention policies based on approved storage capacity and reporting needs.

Use supported ADOM/device reassignment procedures and revise reports, handlers and permissions for the target ADOM. That action applies when an MSSP moves one FortiGate from an initial onboarding ADOM into a production ADOM without reviewing downstream dashboards. It does not resolve the current source condition: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. The relevant correction is: Set feasible Analytics and Archive retention policies based on approved storage capacity and reporting needs.

Correlate enrichment with approved asset inventory, detection logs and observed behavior before containment. That action applies when a public IP is marked malicious by one reputation service but the organization owns the address for approved scanners. It does not resolve the current source condition: A FortiOS connector status shows healthy, but a containment playbook fails with a webhook action not found. The relevant correction is: Verify the enabled Incoming Webhook automation rule name and refresh the FortiOS connector action list.

Add traceable device identifiers, input values and task outcomes to the incident audit evidence. That action applies when a response engineer wants to roll back a failed containment action but the playbook has no record of which firewall or indicator was changed. It does not resolve the current source condition: A FortiOS connector status shows healthy, but a containment playbook fails with a webhook action not found. The relevant correction is: Verify the enabled Incoming Webhook automation rule name and refresh the FortiOS connector action list.

Verify selected ADOM, filtered case scope and recipient entitlement before exporting sensitive evidence. That action applies when a SOC leader exports all incidents as PDF for a customer, including cases from another ADOM not covered by the contract. It does not resolve the current source condition: A FortiOS connector status shows healthy, but a containment playbook fails with a webhook action not found. The relevant correction is: Verify the enabled Incoming Webhook automation rule name and refresh the FortiOS connector action list.

The output shows separate permitted and blocked counts matching a controlled Log View sample. That outcome would be relevant when an auditor wants a comparison of allowed and blocked connections, but a custom dataset uses a filter that excludes denied actions. The decisive evidence is: A test report saves to its designated location without broadening unrelated file permissions.

Two test runs consistently include the intended daily or monthly periods. That outcome would be relevant when a report calendar entry launches at the expected time, but the incident summaries use the wrong timezone boundary. The decisive evidence is: A test report saves to its designated location without broadening unrelated file permissions.

The report includes the intended records after they become queryable or the limitation is documented. That outcome would be relevant when a monthly report contains no data although matching events are visible in Log View's real-time display. The decisive evidence is: A test report saves to its designated location without broadening unrelated file permissions.

Check task report identity, triggering ADOM and permissions, then bind the correct scoped report. That action applies when a response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. It does not resolve the current source condition: A SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. The relevant correction is: Add a separately approved remediation stage or handoff after the vulnerability information task.

Create and enable the appropriate FortiGate Incoming Webhook automation rule for the authorized connector. That action applies when a playbook performs IP containment but the FortiOS connector lists no matching FortiGate action and no enabled Incoming Webhook automation rule exists on that firewall. It does not resolve the current source condition: A SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. The relevant correction is: Add a separately approved remediation stage or handoff after the vulnerability information task.

Inspect associated indicators and actual response actions for each affected asset separately. That action applies when an incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. It does not resolve the current source condition: A SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. The relevant correction is: Add a separately approved remediation stage or handoff after the vulnerability information task.

Capture a self-contained view label recording timeframe, filters, source devices and measurement units. That action applies when an analyst presents a FortiView chart screenshot without its ADOM or query window and management compares it with a later chart. It does not resolve the current source condition: A network technician changes a firewall policy and assumes the resulting traffic spike proves a new intrusion signature was triggered. The relevant correction is: Correlate administrative configuration events, traffic activity and separate IPS signature logs.

Reduce the request to supported Analytics dates or follow the documented archival restoration process before generating. That action applies when a historical report never finishes because the selected retention period is longer than the SQL Analytics window and expensive reconstruction is unplanned. It does not resolve the current source condition: A network technician changes a firewall policy and assumes the resulting traffic spike proves a new intrusion signature was triggered. The relevant correction is: Correlate administrative configuration events, traffic activity and separate IPS signature logs.

Check source and destination context, application, reputation, action and corroborating records before proposing policy changes. That action applies when a FortiGate traffic record shows a country-based destination, and a team blocks all IPs in that country based on one event. It does not resolve the current source condition: A network technician changes a firewall policy and assumes the resulting traffic spike proves a new intrusion signature was triggered. The relevant correction is: Correlate administrative configuration events, traffic activity and separate IPS signature logs.

Define the required cross-event sequence and correlation conditions within the supported handler type. That action applies when a security analyst creates a correlation handler but supplies only one generic traffic-log rule and expects ordered two-stage behavior. It does not resolve the current source condition: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. The relevant correction is: Clone the supported predefined handler and tune the customer version without damaging the reference rule.

Normalize indicator syntax and review associations before drawing conclusions about separate infrastructure. That action applies when an analyst creates two indicators for the same domain with different case and trailing-dot spelling and counts them as two distinct threat actors. It does not resolve the current source condition: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. The relevant correction is: Clone the supported predefined handler and tune the customer version without damaging the reference rule.

Review upstream outputs and update all dependent task parameters in the playbook designer. That action applies when the SOC changes a playbook variable name but leaves downstream task mappings referencing its former name. It does not resolve the current source condition: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. The relevant correction is: Clone the supported predefined handler and tune the customer version without damaging the reference rule.