To address: A monthly report contains no data although matching events are visible in Log View's real-time display. a SOC analyst recommends: Check Analytics SQL insertion, date filtering and ADOM log retention instead of blaming the report renderer. Which technical principle is central?
Report SQL datasets generally rely on indexed Analytics logs rather than merely arrived files. A targeted response is to check Analytics SQL insertion, date filtering and ADOM log retention instead of blaming the report renderer. This matters when a monthly report contains no data although matching events are visible in Log View's real-time display. A successful test shows: The report includes the intended records after they become queryable or the limitation is documented.
FortiAnalyzer chart libraries support custom chart definitions referenced by specific report layouts. That principle matters when a SOC report needs one new custom chart, but an engineer overwrites a built-in chart shared by other reports. It is not the mechanism explaining the selected response to the present facts. Report SQL datasets generally rely on indexed Analytics logs rather than merely arrived files.
Report execution depends on background tasks and FortiAnalyzer database availability. That principle matters when a scheduled report remains Pending for hours, and the team immediately edits report charts without checking system tasks. It is not the mechanism explaining the selected response to the present facts. Report SQL datasets generally rely on indexed Analytics logs rather than merely arrived files.
Charts and macros are independent dataset consumers unless their time and scope are deliberately aligned. That principle matters when a report has separate numeric charts and a text macro sourced from different time intervals, leading to conflicting values. It is not the mechanism explaining the selected response to the present facts. Report SQL datasets generally rely on indexed Analytics logs rather than merely arrived files.
A FortiAnalyzer security review notes: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. Which failure consequence follows most directly?
A dataset bound to the wrong device log type can return no rows despite available logs. The exposure is present because An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. FortiAnalyzer behavior explains why: FortiAnalyzer dataset query scope includes device and log type as well as SQL predicates. The corrective approach is: Use the dataset log-type selector appropriate to the actual device and ADOM before testing the query.
Unqualified geolocation can create false travel anomalies for remote-access users. Such a failure could arise when a report of impossible travel uses geographic IP lookup but the user connects through a corporate VPN egress in another country. Here the stated problem is specifically: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. Its direct exposure is: A dataset bound to the wrong device log type can return no rows despite available logs.
Deleting shared report dependencies can break downstream charts and report layouts. Such a failure could arise when a chart fails to display after the analyst deletes a custom dataset that the chart still references. Here the stated problem is specifically: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. Its direct exposure is: A dataset bound to the wrong device log type can return no rows despite available logs.
Correlated events may feed incidents, so counts of the two objects are not interchangeable. Such a failure could arise when a SOC dashboard counts several high-severity events but the team interprets that as the number of open incidents. Here the stated problem is specifically: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. Its direct exposure is: A dataset bound to the wrong device log type can return no rows despite available logs.
The following operational condition is unresolved: An operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. Which remediation is most defensible?
Test the revised handler on future events and explicitly review earlier incidents using approved procedures. In this case, an operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. The product behavior is: Event handler configuration affects new matches and is separate from incident history and disposition. Confirm the remedy with this result: New events use the intended severity while historical case changes are deliberate and audited.
Filter and sort the incident table by appropriate status and severity while preserving the original case list. That action applies when a case handler wants a quick view of which incidents are still active but the dashboard mixes remediated and unresolved statuses. It does not resolve the current source condition: An operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. The relevant correction is: Test the revised handler on future events and explicitly review earlier incidents using approved procedures.
Inspect associated indicators and actual response actions for each affected asset separately. That action applies when an incident created from an outbreak event is incorrectly described as automatically containing all affected hosts. It does not resolve the current source condition: An operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. The relevant correction is: Test the revised handler on future events and explicitly review earlier incidents using approved procedures.
Narrow source log type, account scope and recurrence threshold using an explicit detection window. That action applies when a new brute-force event handler triggers for all failed logins across the entire company, producing hundreds of low-value alerts per minute. It does not resolve the current source condition: An operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. The relevant correction is: Test the revised handler on future events and explicitly review earlier incidents using approved procedures.
A FortiAnalyzer 7.6 analyst finds: A responder attaches only a dashboard screenshot to an incident and later loses the underlying event filter criteria. Which corrective response best addresses the issue?
Attach or record bounded source event references, search criteria and relevant timestamps in the incident. In this case, A responder attaches only a dashboard screenshot to an incident and later loses the underlying event filter criteria. The product behavior is: Incident case files benefit from linked source logs and reproducible investigative context. Confirm the remedy with this result: A separate analyst can reproduce the evidence set without relying on visual memory of a dashboard.
Apply supported identity or grouping criteria so correlated source evidence belongs to the same intended endpoint. That action applies when a correlation rule detects suspicious DNS and IPS records but the team has not verified they refer to the same host. It does not resolve the current source condition: A responder attaches only a dashboard screenshot to an incident and later loses the underlying event filter criteria. The relevant correction is: Attach or record bounded source event references, search criteria and relevant timestamps in the incident.
Assign the required scoped read-write administration profile to the authorized automation maintainer. That action applies when a security engineer creates a playbook but cannot edit or run it due to read-only Incidents and Events access. It does not resolve the current source condition: A responder attaches only a dashboard screenshot to an incident and later loses the underlying event filter criteria. The relevant correction is: Attach or record bounded source event references, search criteria and relevant timestamps in the incident.
Distinguish local infrastructure indicators from public reputationally enrichable IP addresses. That action applies when a threat analyst creates an IP indicator using a private RFC1918 address and expects external reputation enrichment to score it globally. It does not resolve the current source condition: A responder attaches only a dashboard screenshot to an incident and later loses the underlying event filter criteria. The relevant correction is: Attach or record bounded source event references, search criteria and relevant timestamps in the incident.
This issue remains unresolved: A Top Applications widget appears empty after a FortiGate configuration disables application-control logging while traffic logs continue. What is the associated operational risk?
Ordinary traffic records do not always carry the same detailed application classification as security-profile records. The exposure is present because A Top Applications widget appears empty after a FortiGate configuration disables application-control logging while traffic logs continue. FortiAnalyzer behavior explains why: FortiView application summaries rely on applicable logged application metadata. The corrective approach is: Verify that the chosen application fields exist in incoming logs and re-enable the intended logging at the source.
Aggregate proxy addresses can conceal distinct client activity and create wrong incident ownership. Such a failure could arise when a FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. Here the stated problem is specifically: A Top Applications widget appears empty after a FortiGate configuration disables application-control logging while traffic logs continue. Its direct exposure is: Ordinary traffic records do not always carry the same detailed application classification as security-profile records.
Timezone mismatch can shift the chosen search window away from the actual suspicious activity. Such a failure could arise when a suspected lateral-movement timeline starts at midnight UTC, yet the response shift uses the local appliance timezone. Here the stated problem is specifically: A Top Applications widget appears empty after a FortiGate configuration disables application-control logging while traffic logs continue. Its direct exposure is: Ordinary traffic records do not always carry the same detailed application classification as security-profile records.
One working chart does not validate the SQL dataset used by every other chart. Such a failure could arise when a report contains a chart with zero rows even though a different chart on the same page is populated. Here the stated problem is specifically: A Top Applications widget appears empty after a FortiGate configuration disables application-control logging while traffic logs continue. Its direct exposure is: Ordinary traffic records do not always carry the same detailed application classification as security-profile records.
The monitoring workflow retains this weakness: A playbook cannot save because its task requires an incident ID that the chosen trigger never supplies. What is the most specific hazard?
A missing upstream context variable prevents safe operation of dependent incident tasks. The exposure is present because A playbook cannot save because its task requires an incident ID that the chosen trigger never supplies. FortiAnalyzer behavior explains why: Playbook configuration must provide the typed inputs required by each connector action. The corrective approach is: Inspect task parameter mappings and add a supported step that resolves the correct incident reference.
Selecting a remote firewall action does not invoke the local report engine. Such a failure could arise when an analyst attempts to run a predefined FortiAnalyzer report from a playbook using an unrelated FortiOS webhook action. Here the stated problem is specifically: A playbook cannot save because its task requires an incident ID that the chosen trigger never supplies. Its direct exposure is: A missing upstream context variable prevents safe operation of dependent incident tasks.
Imported automation definitions can carry stale endpoints and unexpectedly disclose incident data. Such a failure could arise when an automation playbook is imported from a lab but includes connectors that point to test endpoints. Here the stated problem is specifically: A playbook cannot save because its task requires an incident ID that the chosen trigger never supplies. Its direct exposure is: A missing upstream context variable prevents safe operation of dependent incident tasks.
Unchecked empty variables can cause malformed or broadly scoped external actions. Such a failure could arise when a playbook's indicator lookup task returns an empty value but the following IP-block action still sends an API request. Here the stated problem is specifically: A playbook cannot save because its task requires an incident ID that the chosen trigger never supplies. Its direct exposure is: A missing upstream context variable prevents safe operation of dependent incident tasks.
The FortiAnalyzer investigation reports: A management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. Which response is most appropriate?
Correlate connector reachability, playbook execution history and task-level outcomes before confirming response. In this case, A management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. The product behavior is: Connector health, playbook execution and external remediation success are different SOC control signals. Confirm the remedy with this result: The case closes only after the expected task results and approved target changes are verified.
Check raw action values and use a validated matching expression covering the intended normalized action set. That action applies when a filter for denied traffic finds no data because source devices label actions with several supported drop and deny variants. It does not resolve the current source condition: A management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. The relevant correction is: Correlate connector reachability, playbook execution history and task-level outcomes before confirming response.
Use supported ADOM/device reassignment procedures and revise reports, handlers and permissions for the target ADOM. That action applies when an MSSP moves one FortiGate from an initial onboarding ADOM into a production ADOM without reviewing downstream dashboards. It does not resolve the current source condition: A management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. The relevant correction is: Correlate connector reachability, playbook execution history and task-level outcomes before confirming response.
Select the authorized ADOM containing the affected devices and verify indicator and incident scope. That action applies when a dashboard widget reports zero indicators after the analyst selects a different ADOM than the one containing the incident. It does not resolve the current source condition: A management report claims that a green connector-health tile proves every scheduled response playbook completed successfully. The relevant correction is: Correlate connector reachability, playbook execution history and task-level outcomes before confirming response.
A FortiAnalyzer engineer selects: Update the connector endpoint and credentials and rerun a harmless connectivity test. for the issue: An imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. Which underlying mechanism supports that choice?
Connector configuration is independent of playbook task topology and must track external service endpoints. A targeted response is to update the connector endpoint and credentials and rerun a harmless connectivity test. This matters when an imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. A successful test shows: The refreshed connector reaches the supported API and later tasks complete in order.
Incident severity should be supported by full case context rather than transient table filtering. That principle matters when an incident's severity is reduced because only one alert remains visible after filters are changed, even though its earlier indicators persist. It is not the mechanism explaining the selected response to the present facts. Connector configuration is independent of playbook task topology and must track external service endpoints.
Notification profiles are distinct from event-handler detection logic in FortiAnalyzer. That principle matters when a predefined IPS event handler matches suspicious traffic, but notifications never reach the SOC mailbox. It is not the mechanism explaining the selected response to the present facts. Connector configuration is independent of playbook task topology and must track external service endpoints.
Playbook execution depends on enabled trigger configuration as well as event arrival. That principle matters when an event-triggered playbook never executes even though the matching event appears in Event Monitor. It is not the mechanism explaining the selected response to the present facts. Connector configuration is independent of playbook task topology and must track external service endpoints.
To resolve: A SOC leader exports all incidents as PDF for a customer, including cases from another ADOM not covered by the contract. the SOC chooses: Verify selected ADOM, filtered case scope and recipient entitlement before exporting sensitive evidence. Which validation result matters most?
The delivered export includes only authorized incident rows and excludes unrelated customer cases. This observation directly tests whether Verify selected ADOM, filtered case scope and recipient entitlement before exporting sensitive evidence. resolved the underlying situation: A SOC leader exports all incidents as PDF for a customer, including cases from another ADOM not covered by the contract.
A test with matched host identifiers raises an event, while unrelated-host records do not. That outcome would be relevant when a correlation rule detects suspicious DNS and IPS records but the team has not verified they refer to the same host. The decisive evidence is: The delivered export includes only authorized incident rows and excludes unrelated customer cases.
The case records whether the address is an authorized scanner or requires a targeted response. That outcome would be relevant when a public IP is marked malicious by one reputation service but the organization owns the address for approved scanners. The decisive evidence is: The delivered export includes only authorized incident rows and excludes unrelated customer cases.
The approved FortiOS action becomes selectable and a test invokes only the intended device operation. That outcome would be relevant when a playbook performs IP containment but the FortiOS connector lists no matching FortiGate action and no enabled Incoming Webhook automation rule exists on that firewall. The decisive evidence is: The delivered export includes only authorized incident rows and excludes unrelated customer cases.
A FortiAnalyzer team will: Check external firewall automation history and resulting security policy or dynamic block state separately. to resolve: An automated response reports a successful FortiAnalyzer task but the target FortiGate still allows the suspicious IP. Which technical behavior makes the solution appropriate?
External remediation requires verification on the enforcing device, not only the playbook scheduler. A targeted response is to check external firewall automation history and resulting security policy or dynamic block state separately. This matters when an automated response reports a successful FortiAnalyzer task but the target FortiGate still allows the suspicious IP. A successful test shows: The target device shows the intended enforcement change and a controlled test reflects it.
FortiAnalyzer local connector Get Endpoint Vulnerabilities is an information-gathering action. That principle matters when a SOC uses the local connector to retrieve endpoint vulnerabilities but assumes that fetching data also patches the endpoint. It is not the mechanism explaining the selected response to the present facts. External remediation requires verification on the enforcing device, not only the playbook scheduler.
Basic event-handler rules can represent alternative triggers rather than mandatory ordered multi-signal matches. That principle matters when a handler uses a broad OR rule across several different events but the analyst intended all signals to be present together. It is not the mechanism explaining the selected response to the present facts. External remediation requires verification on the enforcing device, not only the playbook scheduler.
Connector configuration is independent of playbook task topology and must track external service endpoints. That principle matters when an imported playbook fails immediately after an API endpoint migration because its connector references the retired URL. It is not the mechanism explaining the selected response to the present facts. External remediation requires verification on the enforcing device, not only the playbook scheduler.
A FortiAnalyzer operator adopts: Integrate the chosen alert with approved incident creation or notification routing and verify ownership. because: An event alert fires but no one receives escalation because the on-call workflow only watches incident cases and ignores event monitoring. Which observation demonstrates the requirement is met?
A triggered critical event reaches the assigned responder through the documented SOC workflow. This observation directly tests whether Integrate the chosen alert with approved incident creation or notification routing and verify ownership. resolved the underlying situation: An event alert fires but no one receives escalation because the on-call workflow only watches incident cases and ignores event monitoring.
The incident list and audit history reflect who owns the investigation and its next action. That outcome would be relevant when a high-severity incident has several events but no assigned owner, and both shifts assume the other is handling it. The decisive evidence is: A triggered critical event reaches the assigned responder through the documented SOC workflow.
A repeat execution enriches or updates the original case without raising duplicate tickets. That outcome would be relevant when an on-demand forensic workflow needs the ability to read incident details but is configured to create a new case each time it runs. The decisive evidence is: A triggered critical event reaches the assigned responder through the documented SOC workflow.
The test log triggers in the correct ADOM without cross-tenant event exposure. That outcome would be relevant when an analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. The decisive evidence is: A triggered critical event reaches the assigned responder through the documented SOC workflow.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
