Plan an independent resilience and evidence-custody strategy matching loss-of-link and appliance failure requirements. That action applies when After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. It does not resolve the current source condition: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. The relevant correction is: Include VDOM and ADOM context in log investigations and apply authorized tenant-specific filters.

Correlate connector reachability, playbook execution history and task-level outcomes before confirming response. That action applies when a management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. It does not resolve the current source condition: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. The relevant correction is: Include VDOM and ADOM context in log investigations and apply authorized tenant-specific filters.

Check raw action values and use a validated matching expression covering the intended normalized action set. That action applies when a filter for denied traffic finds no data because source devices label actions with several supported drop and deny variants. It does not resolve the current source condition: A large Fabric has multiple VDOMs, but an analyst filters only by FortiGate chassis and treats traffic from all VDOMs as one tenant. The relevant correction is: Include VDOM and ADOM context in log investigations and apply authorized tenant-specific filters.

Constrain the playbook trigger to documented event conditions and suitable minimum severity. That action applies when a playbook is enabled but creates incidents for every low-severity event because its trigger filter has no threshold. It does not resolve the current source condition: An analyst edits an event-handler condition and assumes it is working without confirming new log records are indexed. The relevant correction is: Validate source logging and Analytics ingestion before performing a controlled positive detection test.

Review complete incident evidence and change history before reclassifying severity based on a filtered view. That action applies when an incident's severity is reduced because only one alert remains visible after filters are changed, even though its earlier indicators persist. It does not resolve the current source condition: An analyst edits an event-handler condition and assumes it is working without confirming new log records are indexed. The relevant correction is: Validate source logging and Analytics ingestion before performing a controlled positive detection test.

Narrow source log type, account scope and recurrence threshold using an explicit detection window. That action applies when a new brute-force event handler triggers for all failed logins across the entire company, producing hundreds of low-value alerts per minute. It does not resolve the current source condition: An analyst edits an event-handler condition and assumes it is working without confirming new log records are indexed. The relevant correction is: Validate source logging and Analytics ingestion before performing a controlled positive detection test.

A basic single-condition handler cannot infer multi-stage attack progression solely from its display name. Such a failure could arise when a security analyst creates a correlation handler but supplies only one generic traffic-log rule and expects ordered two-stage behavior. Here the stated problem is specifically: A playbook is enabled but creates incidents for every low-severity event because its trigger filter has no threshold. Its direct exposure is: An overbroad automation trigger can flood case management or initiate unnecessary response.

An unauthorized device cannot be safely selected as a trusted automation target. Such a failure could arise when a network team adds an external FortiOS connector but fails to register the FortiGate in the active ADOM. Here the stated problem is specifically: A playbook is enabled but creates incidents for every low-severity event because its trigger filter has no threshold. Its direct exposure is: An overbroad automation trigger can flood case management or initiate unnecessary response.

Local task completion can be mistaken for end-to-end mitigation success. Such a failure could arise when an automated response reports a successful FortiAnalyzer task but the target FortiGate still allows the suspicious IP. Here the stated problem is specifically: A playbook is enabled but creates incidents for every low-severity event because its trigger filter has no threshold. Its direct exposure is: An overbroad automation trigger can flood case management or initiate unnecessary response.

A reachable FortiAnalyzer address alone does not ensure the sending device is authorized to submit logs. Such a failure could arise when a branch FortiGate points its remote logging destination at FortiAnalyzer, but the analyst cannot find any device in Device Manager. Here the stated problem is specifically: The SOC compares new 7.6 log fields with a legacy saved filter and assumes blank values mean no suspicious activity. Its direct exposure is: A field-name migration can make a working ingestion pipeline look empty to legacy searches.

Reusing the previous display name without identity reconciliation can split or misjoin investigation evidence. Such a failure could arise when After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. Here the stated problem is specifically: The SOC compares new 7.6 log fields with a legacy saved filter and assumes blank values mean no suspicious activity. Its direct exposure is: A field-name migration can make a working ingestion pipeline look empty to legacy searches.

Stored Archive files do not automatically behave as on-line SQL rows for every historical report. Such a failure could arise when a customer retains compressed Archive logs for a year but tries to run a report against that full year when Analytics retention is shorter. Here the stated problem is specifically: The SOC compares new 7.6 log fields with a legacy saved filter and assumes blank values mean no suspicious activity. Its direct exposure is: A field-name migration can make a working ingestion pipeline look empty to legacy searches.

Report grouping is an organizational layer and does not replace ADOM or user access boundaries. That principle matters when Management wants a new report folder per business unit, but reports are currently saved together with no permissions review. It is not the mechanism explaining the selected response to the present facts. Report execution depends on background tasks and FortiAnalyzer database availability.

Report output size and destination constraints need to be considered during layout configuration. That principle matters when a weekly PDF report becomes too large to email because it includes extensive raw log tables and high-resolution images. It is not the mechanism explaining the selected response to the present facts. Report execution depends on background tasks and FortiAnalyzer database availability.

Report SQL datasets generally rely on indexed Analytics logs rather than merely arrived files. That principle matters when a monthly report contains no data although matching events are visible in Log View's real-time display. It is not the mechanism explaining the selected response to the present facts. Report execution depends on background tasks and FortiAnalyzer database availability.

Create a supported URL indicator, associate it with the incident and perform justified enrichment. That action applies when a newly discovered malicious URL is entered only as a note in an incident rather than a typed indicator. It does not resolve the current source condition: A malicious indicator is enriched successfully but its last-seen timestamp is weeks older than the investigation window. The relevant correction is: Check enrichment age and corroborate with fresh observed source records before initiating a block.

Inspect playbook task execution history and external target state for each action independently. That action applies when a playbook writes an incident note successfully but the team assumes all following connector calls must also have succeeded. It does not resolve the current source condition: A malicious indicator is enriched successfully but its last-seen timestamp is weeks older than the investigation window. The relevant correction is: Check enrichment age and corroborate with fresh observed source records before initiating a block.

Create or apply the rule within the authorized ADOM that contains those device logs. That action applies when an analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. It does not resolve the current source condition: A malicious indicator is enriched successfully but its last-seen timestamp is weeks older than the investigation window. The relevant correction is: Check enrichment age and corroborate with fresh observed source records before initiating a block.

Document the event's evidence and use the defined escalation or manual incident-creation criteria. That action applies when an analyst labels a detection as an incident even though only one low-confidence event is present and no correlation rule fired. It does not resolve the current source condition: An analyst presents a FortiView chart screenshot without its ADOM or query window and management compares it with a later chart. The relevant correction is: Capture a self-contained view label recording timeframe, filters, source devices and measurement units.

Drill into IPS actions, signature severities and affected devices for the contributing events. That action applies when a FortiView Threats pane reports elevated intrusion activity but the SOC team assumes this means every attack was successful. It does not resolve the current source condition: An analyst presents a FortiView chart screenshot without its ADOM or query window and management compares it with a later chart. The relevant correction is: Capture a self-contained view label recording timeframe, filters, source devices and measurement units.

Reduce the request to supported Analytics dates or follow the documented archival restoration process before generating. That action applies when a historical report never finishes because the selected retention period is longer than the SQL Analytics window and expensive reconstruction is unplanned. It does not resolve the current source condition: An analyst presents a FortiView chart screenshot without its ADOM or query window and management compares it with a later chart. The relevant correction is: Capture a self-contained view label recording timeframe, filters, source devices and measurement units.

Refine the detection with appropriate correlation logic or independent grouped conditions for the intended requirement. That action applies when a handler uses a broad OR rule across several different events but the analyst intended all signals to be present together. It does not resolve the current source condition: An analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. The relevant correction is: Create or apply the rule within the authorized ADOM that contains those device logs.

Place indicator enrichment and aggregation tasks before the final incident evidence-attachment step. That action applies when a response playbook must enrich a suspicious URL before adding context to an incident, but the enrichment task runs after the attachment step. It does not resolve the current source condition: An analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. The relevant correction is: Create or apply the rule within the authorized ADOM that contains those device logs.

Filter and sort the incident table by appropriate status and severity while preserving the original case list. That action applies when a case handler wants a quick view of which incidents are still active but the dashboard mixes remediated and unresolved statuses. It does not resolve the current source condition: An analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. The relevant correction is: Create or apply the rule within the authorized ADOM that contains those device logs.

Outbreak-driven incident creation is detection workflow, not guaranteed endpoint isolation. Such a failure could arise when an incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. Here the stated problem is specifically: A SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. Its direct exposure is: Automated evidence collection and endpoint patching are different operations with different privileges.

Notification profiles may disclose source addresses and security incidents to unauthorized recipients. Such a failure could arise when the SOC adds a custom handler with an email notification recipient outside the designated customer tenant. Here the stated problem is specifically: A SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. Its direct exposure is: Automated evidence collection and endpoint patching are different operations with different privileges.

Read-only investigation access is not sufficient to alter operational automation logic. Such a failure could arise when a security engineer creates a playbook but cannot edit or run it due to read-only Incidents and Events access. Here the stated problem is specifically: A SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. Its direct exposure is: Automated evidence collection and endpoint patching are different operations with different privileges.

A controlled report fills the intended column with known representative values. That outcome would be relevant when a generated report shows a blank column after a custom dataset alias is changed without updating chart data bindings. The decisive evidence is: The delivered PDF contains complete chart labels, axis values and summaries without clipping.

The same chart returns correct rows for two controlled report periods when no hardcoded date restricts it. That outcome would be relevant when the reporting team adds a chart for monthly top destinations but selects a one-day dataset test and believes the chart will always show only one day. The decisive evidence is: The delivered PDF contains complete chart labels, axis values and summaries without clipping.

The generated report displays the intended additional service measure with correct query scope. That outcome would be relevant when a built-in report is used for a custom network service but lacks a required dataset field not present in the standard chart. The decisive evidence is: The delivered PDF contains complete chart labels, axis values and summaries without clipping.

Unordered task dependencies can trigger actions with missing or stale parameters. Such a failure could arise when a playbook's second task starts before the first task supplies its required IP variable, causing an empty block request. Here the stated problem is specifically: A burst of login failures generates independent alerts for every request because no group-by key or recurrence threshold was configured. Its direct exposure is: One-alert-per-log behavior can overload investigation queues and distort incident counts.

Misunderstanding basic OR semantics can escalate any one weak indicator as a complete attack. Such a failure could arise when a handler uses a broad OR rule across several different events but the analyst intended all signals to be present together. Here the stated problem is specifically: A burst of login failures generates independent alerts for every request because no group-by key or recurrence threshold was configured. Its direct exposure is: One-alert-per-log behavior can overload investigation queues and distort incident counts.

A started enrichment task is not the same as persisted validated intelligence. Such a failure could arise when an analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. Here the stated problem is specifically: A burst of login failures generates independent alerts for every request because no group-by key or recurrence threshold was configured. Its direct exposure is: One-alert-per-log behavior can overload investigation queues and distort incident counts.