Define the required cross-event sequence and correlation conditions within the supported handler type. That action applies when a security analyst creates a correlation handler but supplies only one generic traffic-log rule and expects ordered two-stage behavior. It does not resolve the current source condition: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. The relevant correction is: Clone the supported predefined handler and tune the customer version without damaging the reference rule.

Normalize indicator syntax and review associations before drawing conclusions about separate infrastructure. That action applies when an analyst creates two indicators for the same domain with different case and trailing-dot spelling and counts them as two distinct threat actors. It does not resolve the current source condition: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. The relevant correction is: Clone the supported predefined handler and tune the customer version without damaging the reference rule.

Review upstream outputs and update all dependent task parameters in the playbook designer. That action applies when the SOC changes a playbook variable name but leaves downstream task mappings referencing its former name. It does not resolve the current source condition: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. The relevant correction is: Clone the supported predefined handler and tune the customer version without damaging the reference rule.

Review notification profiles, ADOM scope and recipient authorization before enabling the handler. That action applies when the SOC adds a custom handler with an email notification recipient outside the designated customer tenant. It does not resolve the current source condition: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. The relevant correction is: Check task report identity, triggering ADOM and permissions, then bind the correct scoped report.

Confirm ADOM context, authorized device serials and connector scope before enabling automation. That action applies when a playbook runs on the wrong tenant after operators copy the workflow into a different ADOM without updating its connector target. It does not resolve the current source condition: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. The relevant correction is: Check task report identity, triggering ADOM and permissions, then bind the correct scoped report.

Select the appropriate local Attach Data to Incident or Update Incident action with the existing incident reference. That action applies when a responder wants to attach evidence to an existing incident but builds a playbook task using the local Create Incident action. It does not resolve the current source condition: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. The relevant correction is: Check task report identity, triggering ADOM and permissions, then bind the correct scoped report.

Stale target URLs can break otherwise valid playbook logic following service migration. Such a failure could arise when an imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. Here the stated problem is specifically: An on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. Its direct exposure is: Enabling an on-demand playbook does not itself install a recurring schedule.

Success of one local task does not imply the entire multi-step response ran to completion. Such a failure could arise when a playbook writes an incident note successfully but the team assumes all following connector calls must also have succeeded. Here the stated problem is specifically: An on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. Its direct exposure is: Enabling an on-demand playbook does not itself install a recurring schedule.

Disabled detections create silent monitoring gaps even while normal log collection continues. Such a failure could arise when a scheduled incident handler was disabled during maintenance but analysts interpret its empty alert list as a quiet network. Here the stated problem is specifically: An on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. Its direct exposure is: Enabling an on-demand playbook does not itself install a recurring schedule.

A controlled matching event generates both an event record and a delivered notification. That outcome would be relevant when a predefined IPS event handler matches suspicious traffic, but notifications never reach the SOC mailbox. The decisive evidence is: The case contains a validated list of hosts with their individual detected and remediated states.

A triggered critical event reaches the assigned responder through the documented SOC workflow. That outcome would be relevant when an event alert fires but no one receives escalation because the on-call workflow only watches incident cases and ignores event monitoring. The decisive evidence is: The case contains a validated list of hosts with their individual detected and remediated states.

Another analyst can reconstruct why the case was dismissed using the retained supporting evidence. That outcome would be relevant when an analyst closes a suspicious incident as false positive without recording which evidence disproved the threat. The decisive evidence is: The case contains a validated list of hosts with their individual detected and remediated states.

Two different test incidents cause the action to receive their respective observed addresses. That outcome would be relevant when a playbook retrieves an indicator but the next task uses a hardcoded demo IP instead of the trigger's variable. The decisive evidence is: The revised handler prioritizes malicious patterns while routine category policy denies are retained only as logs.

The incident distinguishes verified surviving data from missing historical source records. That outcome would be relevant when an investigation has no linked logs because analytics retention expired, but the case owner still cites a specific original file hash as proven. The decisive evidence is: The revised handler prioritizes malicious patterns while routine category policy denies are retained only as logs.

A safe simulated antivirus event triggers while ordinary web traffic does not. That outcome would be relevant when an event handler is configured to detect malware quarantine, but its filter searches generic traffic logs instead of antivirus records. The decisive evidence is: The revised handler prioritizes malicious patterns while routine category policy denies are retained only as logs.

A test alert identifies the actual affected device and the intended incident-response owner. That outcome would be relevant when a threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. The decisive evidence is: Lab scanning no longer pages incident response while equivalent unauthorized production probes still alert.

The test containment affects only the intended FortiGate and leaves peer devices unchanged. That outcome would be relevant when a FortiGate group has three devices sharing a webhook action name, and the playbook blocks an IP on the wrong firewall. The decisive evidence is: Lab scanning no longer pages incident response while equivalent unauthorized production probes still alert.

The target case gains the new evidence without creating a duplicate incident. That outcome would be relevant when a responder wants to attach evidence to an existing incident but builds a playbook task using the local Create Incident action. The decisive evidence is: Lab scanning no longer pages incident response while equivalent unauthorized production probes still alert.

Visible real-time Archive logs are not guaranteed to have been inserted into the reporting database. Such a failure could arise when a monthly report contains no data although matching events are visible in Log View's real-time display. Here the stated problem is specifically: A built-in report is used for a custom network service but lacks a required dataset field not present in the standard chart. Its direct exposure is: Renaming a built-in report cannot create a new field or query result by itself.

Changing shared built-in definitions is unsafe and may not be supported by the product interface. Such a failure could arise when a chart with a predefined dataset is copied into a customer template, but the analyst expects to edit the built-in dataset in place. Here the stated problem is specifically: A built-in report is used for a custom network service but lacks a required dataset field not present in the standard chart. Its direct exposure is: Renaming a built-in report cannot create a new field or query result by itself.

Mismatched report attachments weaken incident evidence and may leak unrelated device details. Such a failure could arise when an analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. Here the stated problem is specifically: A built-in report is used for a custom network service but lacks a required dataset field not present in the standard chart. Its direct exposure is: Renaming a built-in report cannot create a new field or query result by itself.

Security Fabric analytics supports cross-source investigation when identity, asset and incident data are correlated. That principle matters when an investigator needs to see a suspected phishing URL in the same context as affected users and devices across the Fabric. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer distinguishes searchable Analytics records from retained Archive files under ADOM storage policies.

Cross-product analytics depend on normalization and supported parser field mappings, not identical raw syntax. That principle matters when an MSSP imports logs from a third-party web gateway but relies on Fortinet-only field names without normalized equivalents. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer distinguishes searchable Analytics records from retained Archive files under ADOM storage policies.

Fortinet devices forward logs using a dedicated encrypted transport to their authorized analysis destination. That principle matters when a site sends encrypted Fortinet log traffic through a firewall that allows HTTPS management but blocks the configured log transport. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer distinguishes searchable Analytics records from retained Archive files under ADOM storage policies.

The dashboard highlights the affected threat category across authorized devices during the incident window. That outcome would be relevant when a security team wants to recognize a regional attack spike but looks only at one device's interface traffic totals. The decisive evidence is: The investigative summary differentiates volume leaders from hosts tied to threat alerts and indicators.

The detection appears in the same queryable SQL time range once Analytics processing catches up. That outcome would be relevant when a real-time log search shows a new IPS detection but a report scheduled seconds earlier excludes that detection. The decisive evidence is: The investigative summary differentiates volume leaders from hosts tied to threat alerts and indicators.

New log records arrive after the route and policy correction while unrelated inbound access stays blocked. That outcome would be relevant when a site sends encrypted Fortinet log traffic through a firewall that allows HTTPS management but blocks the configured log transport. The decisive evidence is: The investigative summary differentiates volume leaders from hosts tied to threat alerts and indicators.

Verify the report output path and write entitlement with the intended restricted service identity. That action applies when a report scheduling task fails after the service account loses permission to the destination folder or remote storage. It does not resolve the current source condition: A report chart fails with an invalid SQL column after the dataset was modified for a new parser release. The relevant correction is: Validate the dataset query against current normalized field names and correct chart bindings.

Choose supported product log sources or normalized common fields and create separate charts when necessary. That action applies when a report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. It does not resolve the current source condition: A report chart fails with an invalid SQL column after the dataset was modified for a new parser release. The relevant correction is: Validate the dataset query against current normalized field names and correct chart bindings.

Configure the intended report run schedule, date period, and delivery destination with a test execution. That action applies when a security officer requests a weekly report, but the administrator creates a correct report definition and never schedules it. It does not resolve the current source condition: A report chart fails with an invalid SQL column after the dataset was modified for a new parser release. The relevant correction is: Validate the dataset query against current normalized field names and correct chart bindings.

A reliable log parser must match the source message grammar rather than one accidental token sequence. That principle matters when a newly customized parser matches a harmless log sample but fails on messages containing quoted spaces in usernames. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer log type and subtype categorization govern where parsed records are queried and displayed.

Central log aggregation improves visibility but does not automatically deliver fault-tolerant source log preservation. That principle matters when After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer log type and subtype categorization govern where parsed records are queried and displayed.

VDOM-aware log metadata and administrative domains allow analysis within distinct virtual firewall contexts. That principle matters when a large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer log type and subtype categorization govern where parsed records are queried and displayed.