A destination-only ranking does not establish which user or process initiated the traffic. Such a failure could arise when an investigator sees an unusual destination in FortiView but lacks the user and application behind the connection. Here the stated problem is specifically: A dashboard uses daily averages and hides a ten-minute spike in outbound sessions during an incident. Its direct exposure is: Broad aggregation intervals can smooth away transient events central to an investigation.

Cached chart results can lag new log data and mislead time-sensitive analysis. Such a failure could arise when a report shows stale counts after an analyst assumes a cached preview was regenerated with every new log. Here the stated problem is specifically: A dashboard uses daily averages and hides a ten-minute spike in outbound sessions during an incident. Its direct exposure is: Broad aggregation intervals can smooth away transient events central to an investigation.

A mutable hostname or IP alone can conceal older activity under a former address. Such a failure could arise when a security analyst searches a compromised server by hostname and obtains no results after its DHCP address changed. Here the stated problem is specifically: A dashboard uses daily averages and hides a ten-minute spike in outbound sessions during an incident. Its direct exposure is: Broad aggregation intervals can smooth away transient events central to an investigation.

Define the required cross-event sequence and correlation conditions within the supported handler type. That action applies when a security analyst creates a correlation handler but supplies only one generic traffic-log rule and expects ordered two-stage behavior. It does not resolve the current source condition: A threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. The relevant correction is: Include appropriate available device and source metadata in handler messages and notification context.

Connect dependent tasks in the correct execution order and map the output variable to the downstream input. That action applies when a playbook's second task starts before the first task supplies its required IP variable, causing an empty block request. It does not resolve the current source condition: A threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. The relevant correction is: Include appropriate available device and source metadata in handler messages and notification context.

Add traceable device identifiers, input values and task outcomes to the incident audit evidence. That action applies when a response engineer wants to roll back a failed containment action but the playbook has no record of which firewall or indicator was changed. It does not resolve the current source condition: A threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. The relevant correction is: Include appropriate available device and source metadata in handler messages and notification context.

A test incident remains non-destructively staged until an approver authorizes the specific target action. That outcome would be relevant when an organization needs analyst approval before blocking an IP, but a newly enabled playbook executes containment immediately. The decisive evidence is: The target device is recognized and supported webhook actions appear to the playbook designer.

A load test stays within target API quotas while preserving alerts for true high-confidence incidents. That outcome would be relevant when a high-volume event storm launches many parallel playbook runs and exhausts connector service rate limits. The decisive evidence is: The target device is recognized and supported webhook actions appear to the playbook designer.

A controlled matching event generates both an event record and a delivered notification. That outcome would be relevant when a predefined IPS event handler matches suspicious traffic, but notifications never reach the SOC mailbox. The decisive evidence is: The target device is recognized and supported webhook actions appear to the playbook designer.

Stored Archive files do not automatically behave as on-line SQL rows for every historical report. Such a failure could arise when a customer retains compressed Archive logs for a year but tries to run a report against that full year when Analytics retention is shorter. Here the stated problem is specifically: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. Its direct exposure is: Overlapping tenant addresses can generate false attributions when VDOM origin is ignored.

Reusing the previous display name without identity reconciliation can split or misjoin investigation evidence. Such a failure could arise when After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. Here the stated problem is specifically: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. Its direct exposure is: Overlapping tenant addresses can generate false attributions when VDOM origin is ignored.

A healthy connector does not mean a playbook trigger occurred or its tasks succeeded. Such a failure could arise when a management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. Here the stated problem is specifically: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. Its direct exposure is: Overlapping tenant addresses can generate false attributions when VDOM origin is ignored.

Clear or document active dashboard filters and compare open-versus-closed incident status counts. That action applies when a SOC dashboard displays an incident count of zero because a saved filter restricts the table to closed incidents only. It does not resolve the current source condition: A customer retains compressed Archive logs for a year but tries to run a report against that full year when Analytics retention is shorter. The relevant correction is: Align the report date range with available Analytics logs or use supported archival retrieval and reprocessing where necessary.

Verify log insertion status and SQL indexing or reconstruction health before editing the report layout. That action applies when a newly received FortiGate log appears in raw form but has not yet appeared in a SQL-driven analytics report. It does not resolve the current source condition: A customer retains compressed Archive logs for a year but tries to run a report against that full year when Analytics retention is shorter. The relevant correction is: Align the report date range with available Analytics logs or use supported archival retrieval and reprocessing where necessary.

Separate device-inventory widgets from alert-event and handler-status checks and test a known detection. That action applies when an analyst believes a high count of devices in the SOC dashboard proves event handlers are actively detecting threats. It does not resolve the current source condition: A customer retains compressed Archive logs for a year but tries to run a report against that full year when Analytics retention is shorter. The relevant correction is: Align the report date range with available Analytics logs or use supported archival retrieval and reprocessing where necessary.

FortiAnalyzer reports combine a report definition, layout content and scheduled generation settings. That principle matters when an analyst edits a report's dataset yet the report continues using an old template revision in the scheduled output. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer report configuration and scheduler operation are distinct from layout design.

Report execution depends on background tasks and FortiAnalyzer database availability. That principle matters when a scheduled report remains Pending for hours, and the team immediately edits report charts without checking system tasks. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer report configuration and scheduler operation are distinct from layout design.

FortiAnalyzer uses configured mail or output delivery channels after the report is rendered. That principle matters when an emailed report is missing despite successful report generation and the SMTP destination recently changed. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer report configuration and scheduler operation are distinct from layout design.

Include denied traffic and security-profile events in the time window, distinguishing connection attempts from completed sessions. That action applies when an analyst searches only permitted connections for a targeted server and concludes there was no reconnaissance. It does not resolve the current source condition: A dashboard shows many blocked web categories but the analyst uses an all-traffic filter and compares the number with the security report. The relevant correction is: Match log type, category, action and time filter between the relevant FortiView widget and report dataset.

Record ADOM, device inventory, access profile and saved time range with each exported result. That action applies when Two analysts compare a saved FortiView filter but their ADOM permissions yield different devices and apparently inconsistent totals. It does not resolve the current source condition: A dashboard shows many blocked web categories but the analyst uses an all-traffic filter and compares the number with the security report. The relevant correction is: Match log type, category, action and time filter between the relevant FortiView widget and report dataset.

Restore or replace the missing dataset reference and validate the chart before running the parent report. That action applies when a chart fails to display after the analyst deletes a custom dataset that the chart still references. It does not resolve the current source condition: A dashboard shows many blocked web categories but the analyst uses an all-traffic filter and compares the number with the security report. The relevant correction is: Match log type, category, action and time filter between the relevant FortiView widget and report dataset.

Inconsistent category and action scopes can make valid dashboards look contradictory. Such a failure could arise when a dashboard shows many blocked web categories but the analyst uses an all-traffic filter and compares the number with the security report. Here the stated problem is specifically: A dashboard displays the highest session-rate sources but the team wants the most data transferred over a month. Its direct exposure is: Treating flow frequency as bandwidth volume can misprioritize exfiltration investigations.

A denied web request should not be interpreted as proof of completed attacker communication. Such a failure could arise when a blocked malicious URL appears in a web-filter log, and the incident owner claims that the destination was reached. Here the stated problem is specifically: A dashboard displays the highest session-rate sources but the team wants the most data transferred over a month. Its direct exposure is: Treating flow frequency as bandwidth volume can misprioritize exfiltration investigations.

Searching only ordinary firewall traffic records can miss management-plane authentication attempts. Such a failure could arise when a suspected brute-force campaign produces hundreds of failed administrator logins from one IP, but a broad traffic-log search hides the login events. Here the stated problem is specifically: A dashboard displays the highest session-rate sources but the team wants the most data transferred over a month. Its direct exposure is: Treating flow frequency as bandwidth volume can misprioritize exfiltration investigations.

A technically valid SQL query against the wrong log type can produce a misleading empty chart. Such a failure could arise when a security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. Here the stated problem is specifically: A report is generated correctly but emailed to an outdated distribution list that includes a former contractor. Its direct exposure is: Correct report data can still leak sensitive content through an incorrect delivery profile.

Permissions on output storage can block report delivery while the SQL query itself succeeds. Such a failure could arise when a report scheduling task fails after the service account loses permission to the destination folder or remote storage. Here the stated problem is specifically: A report is generated correctly but emailed to an outdated distribution list that includes a former contractor. Its direct exposure is: Correct report data can still leak sensitive content through an incorrect delivery profile.

Screenshots do not preserve query logic, chart bindings or runtime report configuration. Such a failure could arise when a custom report must be reused after FortiAnalyzer replacement, but the team exports only a screenshot of its layout. Here the stated problem is specifically: A report is generated correctly but emailed to an outdated distribution list that includes a former contractor. Its direct exposure is: Correct report data can still leak sensitive content through an incorrect delivery profile.

Record ADOM, device inventory, access profile and saved time range with each exported result. That action applies when Two analysts compare a saved FortiView filter but their ADOM permissions yield different devices and apparently inconsistent totals. It does not resolve the current source condition: A report contains a chart with zero rows even though a different chart on the same page is populated. The relevant correction is: Inspect the empty chart's dataset, log type and filters independently of the populated chart.

Check source and destination context, application, reputation, action and corroborating records before proposing policy changes. That action applies when a FortiGate traffic record shows a country-based destination, and a team blocks all IPs in that country based on one event. It does not resolve the current source condition: A report contains a chart with zero rows even though a different chart on the same page is populated. The relevant correction is: Inspect the empty chart's dataset, log type and filters independently of the populated chart.

Review the report's device or ADOM selection and rerun with the intended registered branch included. That action applies when a manager complains a report omits a new branch although its FortiGate is now authorized and sending logs. It does not resolve the current source condition: A report contains a chart with zero rows even though a different chart on the same page is populated. The relevant correction is: Inspect the empty chart's dataset, log type and filters independently of the populated chart.

Drill into outbreak events and associated incidents, then verify actual response actions per affected host. That action applies when an analyst sees an outbreak alert counter increase and treats it as proof that all infected hosts have already been contained. It does not resolve the current source condition: After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. The relevant correction is: Plan an independent resilience and evidence-custody strategy matching loss-of-link and appliance failure requirements.

Register and authorize the replacement serial and update authorized device selections in reports and searches. That action applies when After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. It does not resolve the current source condition: After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. The relevant correction is: Plan an independent resilience and evidence-custody strategy matching loss-of-link and appliance failure requirements.

Test parser matching against varied representative event formats including quoted and optional fields. That action applies when a newly customized parser matches a harmless log sample but fails on messages containing quoted spaces in usernames. It does not resolve the current source condition: After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. The relevant correction is: Plan an independent resilience and evidence-custody strategy matching loss-of-link and appliance failure requirements.