Select the FortiView application view and rank by measured bytes or bandwidth over a fixed window. That action applies when a manager wants a trend of applications consuming the most bandwidth, but the analyst opens a widget ranked by session count. It does not resolve the current source condition: A one-hour dashboard reveals no web-filter attacks, while the incident ticket covers the entire previous weekend. The relevant correction is: Widen the FortiView filter to the documented incident interval and retain log-category restrictions.

Filter system and authentication event logs by source IP, administrator result and incident time range. That action applies when a suspected brute-force campaign produces hundreds of failed administrator logins from one IP, but a broad traffic-log search hides the login events. It does not resolve the current source condition: A one-hour dashboard reveals no web-filter attacks, while the incident ticket covers the entire previous weekend. The relevant correction is: Widen the FortiView filter to the documented incident interval and retain log-category restrictions.

Review the report's device or ADOM selection and rerun with the intended registered branch included. That action applies when a manager complains a report omits a new branch although its FortiGate is now authorized and sending logs. It does not resolve the current source condition: A one-hour dashboard reveals no web-filter attacks, while the incident ticket covers the entire previous weekend. The relevant correction is: Widen the FortiView filter to the documented incident interval and retain log-category restrictions.

Enabling an on-demand playbook does not itself install a recurring schedule. Such a failure could arise when an on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. Here the stated problem is specifically: A playbook runs on the wrong tenant after operators copy the workflow into a different ADOM without updating its connector target. Its direct exposure is: Cross-tenant connector mismatch can trigger security changes outside the analyst's authority.

Hardcoded values can send response commands to unrelated or stale systems. Such a failure could arise when a playbook retrieves an indicator but the next task uses a hardcoded demo IP instead of the trigger's variable. Here the stated problem is specifically: A playbook runs on the wrong tenant after operators copy the workflow into a different ADOM without updating its connector target. Its direct exposure is: Cross-tenant connector mismatch can trigger security changes outside the analyst's authority.

Read-only investigation access is not sufficient to alter operational automation logic. Such a failure could arise when a security engineer creates a playbook but cannot edit or run it due to read-only Incidents and Events access. Here the stated problem is specifically: A playbook runs on the wrong tenant after operators copy the workflow into a different ADOM without updating its connector target. Its direct exposure is: Cross-tenant connector mismatch can trigger security changes outside the analyst's authority.

FortiAnalyzer log lifecycle is governed by per-ADOM retention rules and available disk resources. That principle matters when a FortiAnalyzer storage alert appears after traffic volume doubles, and operations responds by increasing only the number of registered devices. It is not the mechanism explaining the selected response to the present facts. Normalization and filter semantics must reflect actual logged values rather than assumed action text.

FortiAnalyzer associates received logs with registered sending device identifiers and ADOM context. That principle matters when Two FortiGates share an administrator naming convention, and operators accidentally merge their traffic conclusions into one device identity. It is not the mechanism explaining the selected response to the present facts. Normalization and filter semantics must reflect actual logged values rather than assumed action text.

Log timestamps require consistent clock synchronization and display normalization for reliable chronology. That principle matters when Firewall logs from two time zones appear reordered when an analyst compares device local timestamps directly. It is not the mechanism explaining the selected response to the present facts. Normalization and filter semantics must reflect actual logged values rather than assumed action text.

Using raw events instead of aggregated data makes summary charts costly and hard to interpret. Such a failure could arise when a report lists ten thousand log records in a table even though the auditor requested a daily summary by device. Here the stated problem is specifically: An analyst edits a report's dataset yet the report continues using an old template revision in the scheduled output. Its direct exposure is: Unreviewed reused templates can leave outdated visuals in otherwise fresh report deliveries.

Changing layout cannot repair a stalled scheduler, database or exhausted resource condition. Such a failure could arise when a scheduled report remains Pending for hours, and the team immediately edits report charts without checking system tasks. Here the stated problem is specifically: An analyst edits a report's dataset yet the report continues using an old template revision in the scheduled output. Its direct exposure is: Unreviewed reused templates can leave outdated visuals in otherwise fresh report deliveries.

Folder organization without authorization checks can encourage accidental cross-unit disclosure. Such a failure could arise when Management wants a new report folder per business unit, but reports are currently saved together with no permissions review. Here the stated problem is specifically: An analyst edits a report's dataset yet the report continues using an old template revision in the scheduled output. Its direct exposure is: Unreviewed reused templates can leave outdated visuals in otherwise fresh report deliveries.

Report date filters must account for consistent timezone and inclusive or exclusive query boundaries. That principle matters when an auditor complains that a report omits the final hour of a reporting day, and administrators assume the missing log records were deleted. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer reports combine a report definition, layout content and scheduled generation settings.

Report dataset design governs which raw attributes appear in generated charts and macros. That principle matters when a junior analyst builds a custom report with confidential usernames in every chart although the audience requires only totals. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer reports combine a report definition, layout content and scheduled generation settings.

Reports can serve as incident evidence only when their device and time scopes match the case. That principle matters when an analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer reports combine a report definition, layout content and scheduled generation settings.

Use available normalized log attributes and document any device-specific fields before building cross-vendor searches. That action applies when an MSSP imports logs from a third-party web gateway but relies on Fortinet-only field names without normalized equivalents. It does not resolve the current source condition: A dashboard widget reports zero indicators after the analyst selects a different ADOM than the one containing the incident. The relevant correction is: Select the authorized ADOM containing the affected devices and verify indicator and incident scope.

Use indicator enrichment for threat context and correlate matching original logs for packet or session evidence. That action applies when a SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. It does not resolve the current source condition: A dashboard widget reports zero indicators after the analyst selects a different ADOM than the one containing the incident. The relevant correction is: Select the authorized ADOM containing the affected devices and verify indicator and incident scope.

Validate the parser and normalized source-IP mapping before correlating the non-Fortinet logs with FortiGate logs. That action applies when a threat hunt filters for a source address but one third-party syslog parser maps that value into an unrelated custom field. It does not resolve the current source condition: A dashboard widget reports zero indicators after the analyst selects a different ADOM than the one containing the incident. The relevant correction is: Select the authorized ADOM containing the affected devices and verify indicator and incident scope.

Restore the correct ADOM, device filter and approved recipient list before regenerating the report. That action applies when a compliance report suddenly contains another customer's data after an administrator changes the ADOM and template target. It does not resolve the current source condition: An incident contains multiple security events, but the handoff report lists the incident creation time as the first malicious activity. The relevant correction is: Extract the earliest relevant source-log time, correlation event time and incident creation time separately.

Include denied traffic and security-profile events in the time window, distinguishing connection attempts from completed sessions. That action applies when an analyst searches only permitted connections for a targeted server and concludes there was no reconnaissance. It does not resolve the current source condition: An incident contains multiple security events, but the handoff report lists the incident creation time as the first malicious activity. The relevant correction is: Extract the earliest relevant source-log time, correlation event time and incident creation time separately.

Record ADOM, device inventory, access profile and saved time range with each exported result. That action applies when Two analysts compare a saved FortiView filter but their ADOM permissions yield different devices and apparently inconsistent totals. It does not resolve the current source condition: An incident contains multiple security events, but the handoff report lists the incident creation time as the first malicious activity. The relevant correction is: Extract the earliest relevant source-log time, correlation event time and incident creation time separately.

FortiAnalyzer ON_DEMAND triggers require explicit manual invocation rather than periodic execution by default. That principle matters when an on-demand playbook is enabled but the analyst expects a scheduled unattended run every morning. It is not the mechanism explaining the selected response to the present facts. Automation connector tasks depend on valid service identity and the target API's access permissions.

Automation can enrich and prepare evidence separately from privileged mitigation actions. That principle matters when an organization needs analyst approval before blocking an IP, but a newly enabled playbook executes containment immediately. It is not the mechanism explaining the selected response to the present facts. Automation connector tasks depend on valid service identity and the target API's access permissions.

Correlation handlers evaluate relationships between qualifying events beyond one independent basic log condition. That principle matters when a security analyst creates a correlation handler but supplies only one generic traffic-log rule and expects ordered two-stage behavior. It is not the mechanism explaining the selected response to the present facts. Automation connector tasks depend on valid service identity and the target API's access permissions.

Dashboard time-scope changes can mimic an attack spike without any new underlying incident. Such a failure could arise when an incident dashboard changes from High to Critical counts after an analyst widens the global time filter, and the team calls it a new outbreak. Here the stated problem is specifically: A FortiView widget shows top source bandwidth but the team claims it lists the most malicious source IPs by risk. Its direct exposure is: Traffic volume alone is not a reliable proxy for maliciousness or incident severity.

Central analytics cannot reconstruct detection details that were never generated or forwarded by the device. Such a failure could arise when a device sends system-event logs but no security-profile logs, and a manager assumes FortiAnalyzer automatically enriches missing signatures. Here the stated problem is specifically: A FortiView widget shows top source bandwidth but the team claims it lists the most malicious source IPs by risk. Its direct exposure is: Traffic volume alone is not a reliable proxy for maliciousness or incident severity.

Connecting management systems does not invent traffic or security logs that the source device never forwards. Such a failure could arise when an analyst expects FortiAnalyzer to begin displaying VPN events immediately after it is added as a Fabric analysis endpoint, but FortiGate logging is disabled. Here the stated problem is specifically: A FortiView widget shows top source bandwidth but the team claims it lists the most malicious source IPs by risk. Its direct exposure is: Traffic volume alone is not a reliable proxy for maliciousness or incident severity.

FortiAnalyzer log lifecycle is governed by per-ADOM retention rules and available disk resources. That principle matters when a FortiAnalyzer storage alert appears after traffic volume doubles, and operations responds by increasing only the number of registered devices. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer receives real-time files before inserting and indexing eligible Analytics data in its SQL database.

SOC outbreak alerts and mitigation execution are distinct stages of a security response workflow. That principle matters when an analyst sees an outbreak alert counter increase and treats it as proof that all infected hosts have already been contained. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer receives real-time files before inserting and indexing eligible Analytics data in its SQL database.

Security Fabric analytics supports cross-source investigation when identity, asset and incident data are correlated. That principle matters when an investigator needs to see a suspected phishing URL in the same context as affected users and devices across the Fabric. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer receives real-time files before inserting and indexing eligible Analytics data in its SQL database.

Event messages can expose selected log attributes needed to contextualize correlated detections. That principle matters when a threat handler sends alerts with no device identifier, preventing analysts from routing tickets to the right branch. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context.

Event-handler matching depends on correct log type, subtype, action and field semantics. That principle matters when an event handler is configured to detect malware quarantine, but its filter searches generic traffic logs instead of antivirus records. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context.

Incident severity should be supported by full case context rather than transient table filtering. That principle matters when an incident's severity is reduced because only one alert remains visible after filters are changed, even though its earlier indicators persist. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context.