Inconsistent category and action scopes can make valid dashboards look contradictory. Such a failure could arise when a dashboard shows many blocked web categories but the analyst uses an all-traffic filter and compares the number with the security report. Here the stated problem is specifically: A suspected brute-force campaign produces hundreds of failed administrator logins from one IP, but a broad traffic-log search hides the login events. Its direct exposure is: Searching only ordinary firewall traffic records can miss management-plane authentication attempts.

Archive-only log files may not be available to the SQL datasets used by the report. Such a failure could arise when a scheduled compliance report is blank for one day although Log View shows Archive records from that date. Here the stated problem is specifically: A suspected brute-force campaign produces hundreds of failed administrator logins from one IP, but a broad traffic-log search hides the login events. Its direct exposure is: Searching only ordinary firewall traffic records can miss management-plane authentication attempts.

Unverified clock offsets can falsely suggest delayed collection or impossible event ordering. Such a failure could arise when a device's current time is wrong by an hour after a daylight-saving transition, but SOC staff assume all displayed events are delayed. Here the stated problem is specifically: A suspected brute-force campaign produces hundreds of failed administrator logins from one IP, but a broad traffic-log search hides the login events. Its direct exposure is: Searching only ordinary firewall traffic records can miss management-plane authentication attempts.

FortiAnalyzer incident analysis brings event associations and log-level data into a central investigation view. That principle matters when an incident lists several indicators but the investigator cannot determine which FortiGate events caused the correlation. It is not the mechanism explaining the selected response to the present facts. Configuration events, flow records and threat-detection records represent different log categories.

FortiAnalyzer administrator authorization is applied alongside the view's filters and scope. That principle matters when Two analysts compare a saved FortiView filter but their ADOM permissions yield different devices and apparently inconsistent totals. It is not the mechanism explaining the selected response to the present facts. Configuration events, flow records and threat-detection records represent different log categories.

Report configuration can restrict which registered devices and ADOM logs enter datasets. That principle matters when a manager complains a report omits a new branch although its FortiGate is now authorized and sending logs. It is not the mechanism explaining the selected response to the present facts. Configuration events, flow records and threat-detection records represent different log categories.

Add traceable device identifiers, input values and task outcomes to the incident audit evidence. That action applies when a response engineer wants to roll back a failed containment action but the playbook has no record of which firewall or indicator was changed. It does not resolve the current source condition: An on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. The relevant correction is: Run it manually or configure an appropriate supported trigger with documented scheduling if available.

Correlate enrichment with approved asset inventory, detection logs and observed behavior before containment. That action applies when a public IP is marked malicious by one reputation service but the organization owns the address for approved scanners. It does not resolve the current source condition: An on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. The relevant correction is: Run it manually or configure an appropriate supported trigger with documented scheduling if available.

Check enrichment age and corroborate with fresh observed source records before initiating a block. That action applies when a malicious indicator is enriched successfully but its last-seen timestamp is weeks older than the investigation window. It does not resolve the current source condition: An on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. The relevant correction is: Run it manually or configure an appropriate supported trigger with documented scheduling if available.

A status change without evidence destroys traceability and can conceal repeated misclassifications. Such a failure could arise when an analyst closes a suspicious incident as false positive without recording which evidence disproved the threat. Here the stated problem is specifically: An administrator uses a ten-second matching window for a low-and-slow password attack that typically spans thirty minutes. Its direct exposure is: An overly narrow time window can evade detection of distributed or low-rate behavior.

Selecting a remote firewall action does not invoke the local report engine. Such a failure could arise when an analyst attempts to run a predefined FortiAnalyzer report from a playbook using an unrelated FortiOS webhook action. Here the stated problem is specifically: An administrator uses a ten-second matching window for a low-and-slow password attack that typically spans thirty minutes. Its direct exposure is: An overly narrow time window can evade detection of distributed or low-rate behavior.

An old handler name does not prove its rules cover new threat signatures or event formats. Such a failure could arise when a SOC manager wants to monitor a newly defined outbreak pattern but uses an outdated built-in handler whose rule list never includes it. Here the stated problem is specifically: An administrator uses a ten-second matching window for a low-and-slow password attack that typically spans thirty minutes. Its direct exposure is: An overly narrow time window can evade detection of distributed or low-rate behavior.

Repeated incident creation by an investigative playbook inflates workload and fragments evidence. Such a failure could arise when an on-demand forensic workflow needs the ability to read incident details but is configured to create a new case each time it runs. Here the stated problem is specifically: An imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. Its direct exposure is: Stale target URLs can break otherwise valid playbook logic following service migration.

A visible event alone does not prove a playbook's trigger is enabled or matches its filter. Such a failure could arise when an event-triggered playbook never executes even though the matching event appears in Event Monitor. Here the stated problem is specifically: An imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. Its direct exposure is: Stale target URLs can break otherwise valid playbook logic following service migration.

Read-only investigation access is not sufficient to alter operational automation logic. Such a failure could arise when a security engineer creates a playbook but cannot edit or run it due to read-only Incidents and Events access. Here the stated problem is specifically: An imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. Its direct exposure is: Stale target URLs can break otherwise valid playbook logic following service migration.

A chart can misrepresent log distribution when grouping columns do not match its configured measures. Such a failure could arise when a custom report produces a pie chart of web categories, but the analyst confuses chart labels with SQL dataset groups. Here the stated problem is specifically: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. Its direct exposure is: A technically valid SQL query against the wrong log type can produce a misleading empty chart.

Visible real-time Archive logs are not guaranteed to have been inserted into the reporting database. Such a failure could arise when a monthly report contains no data although matching events are visible in Log View's real-time display. Here the stated problem is specifically: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. Its direct exposure is: A technically valid SQL query against the wrong log type can produce a misleading empty chart.

Unchanged cloned device filters silently omit sources from an otherwise valid report. Such a failure could arise when an analyst builds a new quarterly report by duplicating a standard report and inadvertently leaves the source-device filter on one branch. Here the stated problem is specifically: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. Its direct exposure is: A technically valid SQL query against the wrong log type can produce a misleading empty chart.

Test parser matching against varied representative event formats including quoted and optional fields. That action applies when a newly customized parser matches a harmless log sample but fails on messages containing quoted spaces in usernames. It does not resolve the current source condition: After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. The relevant correction is: Register and authorize the replacement serial and update authorized device selections in reports and searches.

Choose appropriate Security Fabric or supported product-specific ADOM organization and validate device type support. That action applies when a Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. It does not resolve the current source condition: After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. The relevant correction is: Register and authorize the replacement serial and update authorized device selections in reports and searches.

Review the effective ADOM storage policy and communicate any impact on existing indexed data before applying changes. That action applies when an administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. It does not resolve the current source condition: After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. The relevant correction is: Register and authorize the replacement serial and update authorized device selections in reports and searches.

Narrow the dataset by applicable date, log type and source predicates and examine query execution cost. That action applies when a high-volume daily report takes far longer than expected after an analyst removes all date and device filters from a custom dataset. It does not resolve the current source condition: An analyst searches only permitted connections for a targeted server and concludes there was no reconnaissance. The relevant correction is: Include denied traffic and security-profile events in the time window, distinguishing connection attempts from completed sessions.

Search the relevant NAT-translated and original address fields, mapped policy and time-bound session identifiers. That action applies when an analyst filters a suspicious session by source IP and sees no event because the traffic passed through source NAT. It does not resolve the current source condition: An analyst searches only permitted connections for a targeted server and concludes there was no reconnaissance. The relevant correction is: Include denied traffic and security-profile events in the time window, distinguishing connection attempts from completed sessions.

Restore the correct ADOM, device filter and approved recipient list before regenerating the report. That action applies when a compliance report suddenly contains another customer's data after an administrator changes the ADOM and template target. It does not resolve the current source condition: An analyst searches only permitted connections for a targeted server and concludes there was no reconnaissance. The relevant correction is: Include denied traffic and security-profile events in the time window, distinguishing connection attempts from completed sessions.

Select the specific prior-month reporting period and document timezone assumptions. That action applies when a regulatory report is supposed to include only prior calendar-month logs but uses an open-ended date range in the schedule. It does not resolve the current source condition: Two report jobs run concurrently against the same large dataset and saturate the analytics system during peak business hours. The relevant correction is: Stagger the reports and constrain heavy datasets according to capacity and business need.

Revise dataset projections to aggregate or pseudonymize identities before distributing the report. That action applies when a junior analyst builds a custom report with confidential usernames in every chart although the audience requires only totals. It does not resolve the current source condition: Two report jobs run concurrently against the same large dataset and saturate the analytics system during peak business hours. The relevant correction is: Stagger the reports and constrain heavy datasets according to capacity and business need.

Compare source event times, query timezone and report interval boundaries before changing retention. That action applies when an auditor complains that a report omits the final hour of a reporting day, and administrators assume the missing log records were deleted. It does not resolve the current source condition: Two report jobs run concurrently against the same large dataset and saturate the analytics system during peak business hours. The relevant correction is: Stagger the reports and constrain heavy datasets according to capacity and business need.

FortiAnalyzer SOC analysis is constrained by the selected administrative domain and analyst permissions. That principle matters when a dashboard widget reports zero indicators after the analyst selects a different ADOM than the one containing the incident. It is not the mechanism explaining the selected response to the present facts. Log attribution involves device and virtual-domain context as well as network flow identifiers.

Log parsing extracts defined fields from source text before downstream normalization and categorization. That principle matters when a partner appliance sends syslog records with an unsupported delimiter, and FortiAnalyzer lists many unknown values. It is not the mechanism explaining the selected response to the present facts. Log attribution involves device and virtual-domain context as well as network flow identifiers.

FortiAnalyzer uses ADOM types and Fabric integration to organize log sources from compatible devices. That principle matters when a Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. It is not the mechanism explaining the selected response to the present facts. Log attribution involves device and virtual-domain context as well as network flow identifiers.

A new report includes post-change log records and its date scope matches the requested time. That outcome would be relevant when a report is sent to its recipient but charts use a stale cache after a major policy change. The decisive evidence is: The query returns expected rows and the chart renders after the schema-compatible change.

The analyst edits the intended customer report but cannot expose reports from another tenant. That outcome would be relevant when an administrator gives a customer analyst unrestricted access to all report definitions so they can edit one custom report. The decisive evidence is: The query returns expected rows and the chart renders after the schema-compatible change.

A controlled import recreates the intended report logic and output after validating dependencies. That outcome would be relevant when a custom report must be reused after FortiAnalyzer replacement, but the team exports only a screenshot of its layout. The decisive evidence is: The query returns expected rows and the chart renders after the schema-compatible change.