Review upstream outputs and update all dependent task parameters in the playbook designer. That action applies when the SOC changes a playbook variable name but leaves downstream task mappings referencing its former name. It does not resolve the current source condition: An event handler uses a source IP grouping key, but all translated clients appear as a single NAT gateway. The relevant correction is: Choose grouping fields and supported original-client context that identify distinct relevant sources.

Inspect associated indicators and actual response actions for each affected asset separately. That action applies when an incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. It does not resolve the current source condition: An event handler uses a source IP grouping key, but all translated clients appear as a single NAT gateway. The relevant correction is: Choose grouping fields and supported original-client context that identify distinct relevant sources.

Apply supported identity or grouping criteria so correlated source evidence belongs to the same intended endpoint. That action applies when a correlation rule detects suspicious DNS and IPS records but the team has not verified they refer to the same host. It does not resolve the current source condition: An event handler uses a source IP grouping key, but all translated clients appear as a single NAT gateway. The relevant correction is: Choose grouping fields and supported original-client context that identify distinct relevant sources.

Formatting changes cannot recover analytic rows already removed by retention policy. Such a failure could arise when a report generation error began immediately after an administrator shortened the ADOM Analytics retention period. Here the stated problem is specifically: A generated report shows a blank column after a custom dataset alias is changed without updating chart data bindings. Its direct exposure is: Uncoordinated SQL alias changes can silently remove chart metrics from report layouts.

Editing shared report objects can cause unintended changes outside the target deliverable. Such a failure could arise when a SOC report needs one new custom chart, but an engineer overwrites a built-in chart shared by other reports. Here the stated problem is specifically: A generated report shows a blank column after a custom dataset alias is changed without updating chart data bindings. Its direct exposure is: Uncoordinated SQL alias changes can silently remove chart metrics from report layouts.

A correctly timed job can still select the wrong records if its date-period interpretation differs. Such a failure could arise when a report calendar entry launches at the expected time, but the incident summaries use the wrong timezone boundary. Here the stated problem is specifically: A generated report shows a blank column after a custom dataset alias is changed without updating chart data bindings. Its direct exposure is: Uncoordinated SQL alias changes can silently remove chart metrics from report layouts.

Normalized fields give FortiAnalyzer compatible query semantics across diverse parsed log formats. That principle matters when a threat hunt filters for a source address but one third-party syslog parser maps that value into an unrelated custom field. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer uses ADOM types and Fabric integration to organize log sources from compatible devices.

FortiAnalyzer log lifecycle is governed by per-ADOM retention rules and available disk resources. That principle matters when a FortiAnalyzer storage alert appears after traffic volume doubles, and operations responds by increasing only the number of registered devices. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer uses ADOM types and Fabric integration to organize log sources from compatible devices.

The SOC dashboard exposes different metrics for device types, events, incidents and automation readiness. That principle matters when an analyst believes a high count of devices in the SOC dashboard proves event handlers are actively detecting threats. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer uses ADOM types and Fabric integration to organize log sources from compatible devices.

The investigation separates reputation indicators from concrete device log events supporting the case. That outcome would be relevant when a SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. The decisive evidence is: Test users view only their assigned customer devices and cannot browse another tenant's logs.

Both simple and complex test messages preserve full usernames and relevant source identifiers. That outcome would be relevant when a newly customized parser matches a harmless log sample but fails on messages containing quoted spaces in usernames. The decisive evidence is: Test users view only their assigned customer devices and cannot browse another tenant's logs.

Missing-window logs appear after transport restoration where supported and their event times remain accurate. That outcome would be relevant when a remote FortiGate has intermittent WAN outages, and analysts expect every incident log to appear live during the link failure. The decisive evidence is: Test users view only their assigned customer devices and cannot browse another tenant's logs.

FortiAnalyzer reports and automation tasks must share a compatible administrative domain and authorization scope. That principle matters when a response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. It is not the mechanism explaining the selected response to the present facts. Operational automation requires durable execution context for audit, incident reconstruction and rollback.

Playbook variables connect incident evidence to the parameters used by follow-on automation tasks. That principle matters when a playbook retrieves an indicator but the next task uses a hardcoded demo IP instead of the trigger's variable. It is not the mechanism explaining the selected response to the present facts. Operational automation requires durable execution context for audit, incident reconstruction and rollback.

The FortiAnalyzer local connector provides a report-generation action independent of FortiGate webhooks. That principle matters when an analyst attempts to run a predefined FortiAnalyzer report from a playbook using an unrelated FortiOS webhook action. It is not the mechanism explaining the selected response to the present facts. Operational automation requires durable execution context for audit, incident reconstruction and rollback.

Central event chronology depends on trustworthy source clocks and correctly interpreted timezone offsets. That principle matters when a device's current time is wrong by an hour after a daylight-saving transition, but SOC staff assume all displayed events are delayed. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer dataset query scope includes device and log type as well as SQL predicates.

FortiGate traffic logging can expose pre- and post-translation fields used for session reconstruction. That principle matters when an analyst filters a suspicious session by source IP and sees no event because the traffic passed through source NAT. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer dataset query scope includes device and log type as well as SQL predicates.

FortiAnalyzer reports generally query indexed Analytics data selected by their datasets. That principle matters when a scheduled compliance report is blank for one day although Log View shows Archive records from that date. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer dataset query scope includes device and log type as well as SQL predicates.

An on-demand trigger cannot silently act as an event-driven automation subscription. Such a failure could arise when a FortiAnalyzer playbook is saved with an ON_DEMAND trigger, yet the team expects it to run automatically whenever a new event appears. Here the stated problem is specifically: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. Its direct exposure is: Overwriting shared baseline logic makes later validation and upgrades difficult.

Changing current detection configuration does not automatically rewrite all previously processed cases. Such a failure could arise when an operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. Here the stated problem is specifically: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. Its direct exposure is: Overwriting shared baseline logic makes later validation and upgrades difficult.

FortiAnalyzer cannot invent FortiGate actions that have not been configured on the target firewall. Such a failure could arise when a playbook performs IP containment but the FortiOS connector lists no matching FortiGate action and no enabled Incoming Webhook automation rule exists on that firewall. Here the stated problem is specifically: A SOC team copies a predefined handler and modifies the original instead of cloning it for customer-specific thresholds. Its direct exposure is: Overwriting shared baseline logic makes later validation and upgrades difficult.

Assuming every product can share an ordinary FortiGate ADOM hides unsupported integrations. Such a failure could arise when a Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. Here the stated problem is specifically: A parser assigns a web-filter log to a generic traffic subtype so category-specific threat views show no events. Its direct exposure is: Misclassified subtypes cause downstream handlers and dashboards to miss log records that physically exist.

An invalid parser can convert useful evidence into incomplete or misleading normalized attributes. Such a failure could arise when a partner appliance sends syslog records with an unsupported delimiter, and FortiAnalyzer lists many unknown values. Here the stated problem is specifically: A parser assigns a web-filter log to a generic traffic subtype so category-specific threat views show no events. Its direct exposure is: Misclassified subtypes cause downstream handlers and dashboards to miss log records that physically exist.

Premature export of an unvalidated dashboard view may omit decisive records or misstate the timeline. Such a failure could arise when an analyst wants to investigate a suspicious host but launches a report export before validating the source-device time range. Here the stated problem is specifically: A parser assigns a web-filter log to a generic traffic subtype so category-specific threat views show no events. Its direct exposure is: Misclassified subtypes cause downstream handlers and dashboards to miss log records that physically exist.

Changing shared built-in definitions is unsafe and may not be supported by the product interface. Such a failure could arise when a chart with a predefined dataset is copied into a customer template, but the analyst expects to edit the built-in dataset in place. Here the stated problem is specifically: A report is sent to its recipient but charts use a stale cache after a major policy change. Its direct exposure is: Cached analytics results can misrepresent recent changes if freshness is not verified.

Visible real-time Archive logs are not guaranteed to have been inserted into the reporting database. Such a failure could arise when a monthly report contains no data although matching events are visible in Log View's real-time display. Here the stated problem is specifically: A report is sent to its recipient but charts use a stale cache after a major policy change. Its direct exposure is: Cached analytics results can misrepresent recent changes if freshness is not verified.

A chart can misrepresent log distribution when grouping columns do not match its configured measures. Such a failure could arise when a custom report produces a pie chart of web categories, but the analyst confuses chart labels with SQL dataset groups. Here the stated problem is specifically: A report is sent to its recipient but charts use a stale cache after a major policy change. Its direct exposure is: Cached analytics results can misrepresent recent changes if freshness is not verified.

Plan an independent resilience and evidence-custody strategy matching loss-of-link and appliance failure requirements. That action applies when After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. It does not resolve the current source condition: A Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. The relevant correction is: Choose appropriate Security Fabric or supported product-specific ADOM organization and validate device type support.

Inspect Analytics insertion backlog, database capacity and device reception separately before adjusting network routes. That action applies when the SQL database is nearly full after a traffic surge, but the team diagnoses a broken FortiGate transport because report data is late. It does not resolve the current source condition: A Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. The relevant correction is: Choose appropriate Security Fabric or supported product-specific ADOM organization and validate device type support.

Start with relevant SOC incident and log drilldowns, then export a bounded evidence set after validating scope. That action applies when an analyst wants to investigate a suspicious host but launches a report export before validating the source-device time range. It does not resolve the current source condition: A Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. The relevant correction is: Choose appropriate Security Fabric or supported product-specific ADOM organization and validate device type support.

Select the FortiView application view and rank by measured bytes or bandwidth over a fixed window. That action applies when a manager wants a trend of applications consuming the most bandwidth, but the analyst opens a widget ranked by session count. It does not resolve the current source condition: A one-hour dashboard reveals no web-filter attacks, while the incident ticket covers the entire previous weekend. The relevant correction is: Widen the FortiView filter to the documented incident interval and retain log-category restrictions.

Filter system and authentication event logs by source IP, administrator result and incident time range. That action applies when a suspected brute-force campaign produces hundreds of failed administrator logins from one IP, but a broad traffic-log search hides the login events. It does not resolve the current source condition: A one-hour dashboard reveals no web-filter attacks, while the incident ticket covers the entire previous weekend. The relevant correction is: Widen the FortiView filter to the documented incident interval and retain log-category restrictions.

Review the report's device or ADOM selection and rerun with the intended registered branch included. That action applies when a manager complains a report omits a new branch although its FortiGate is now authorized and sending logs. It does not resolve the current source condition: A one-hour dashboard reveals no web-filter attacks, while the incident ticket covers the entire previous weekend. The relevant correction is: Widen the FortiView filter to the documented incident interval and retain log-category restrictions.