The following operational condition is unresolved: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. Which remediation is most defensible?
Select the applicable IPS log type and construct a dataset query with the intended blocked action filter. In this case, A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. The product behavior is: FortiAnalyzer datasets define which SQL log data is supplied to charts and report macros. Confirm the remedy with this result: A controlled blocked-IPS sample contributes to the chart while unrelated permitted traffic does not.
Edit the report target devices and ADOM scope to the authorized quarterly population. That action applies when an analyst builds a new quarterly report by duplicating a standard report and inadvertently leaves the source-device filter on one branch. It does not resolve the current source condition: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. The relevant correction is: Select the applicable IPS log type and construct a dataset query with the intended blocked action filter.
Select the specific prior-month reporting period and document timezone assumptions. That action applies when a regulatory report is supposed to include only prior calendar-month logs but uses an open-ended date range in the schedule. It does not resolve the current source condition: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. The relevant correction is: Select the applicable IPS log type and construct a dataset query with the intended blocked action filter.
Distinguish dataset SQL predicates from the report's selected date interval and chart filters. That action applies when the reporting team adds a chart for monthly top destinations but selects a one-day dataset test and believes the chart will always show only one day. It does not resolve the current source condition: A security report needs a chart of blocked IPS events, but the analyst builds a dataset from ordinary traffic logs only. The relevant correction is: Select the applicable IPS log type and construct a dataset query with the intended blocked action filter.
The team implements this response: Use available normalized log attributes and document any device-specific fields before building cross-vendor searches. The problem is: An MSSP imports logs from a third-party web gateway but relies on Fortinet-only field names without normalized equivalents. Which evidence best proves success?
One query returns meaningful comparable fields from supported gateway and FortiGate record examples. This observation directly tests whether Use available normalized log attributes and document any device-specific fields before building cross-vendor searches. resolved the underlying situation: An MSSP imports logs from a third-party web gateway but relies on Fortinet-only field names without normalized equivalents.
Authorized FortiGate and non-FortiGate device logs appear under their supported ADOM context. That outcome would be relevant when a Security Fabric contains several types of Fortinet products, and the team tries to place every product in a FortiGate-only ADOM. The decisive evidence is: One query returns meaningful comparable fields from supported gateway and FortiGate record examples.
The detection appears in the same queryable SQL time range once Analytics processing catches up. That outcome would be relevant when a real-time log search shows a new IPS detection but a report scheduled seconds earlier excludes that detection. The decisive evidence is: One query returns meaningful comparable fields from supported gateway and FortiGate record examples.
The investigation separates reputation indicators from concrete device log events supporting the case. That outcome would be relevant when a SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. The decisive evidence is: One query returns meaningful comparable fields from supported gateway and FortiGate record examples.
To address: An analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. a SOC analyst recommends: Confirm report source devices and incident ADOM before attaching the report as evidence. Which technical principle is central?
Reports can serve as incident evidence only when their device and time scopes match the case. A targeted response is to confirm report source devices and incident ADOM before attaching the report as evidence. This matters when an analyst attaches a finished report to an incident manually but mistakenly selects a report for the wrong device group. A successful test shows: The incident references an accurate report for its relevant affected assets and period.
Report datasets are executable SQL queries that depend on the available log schema. That principle matters when a report chart fails with an invalid SQL column after the dataset was modified for a new parser release. It is not the mechanism explaining the selected response to the present facts. Reports can serve as incident evidence only when their device and time scopes match the case.
Report generation and storage delivery require distinct filesystem or external-service authorization. That principle matters when a report scheduling task fails after the service account loses permission to the destination folder or remote storage. It is not the mechanism explaining the selected response to the present facts. Reports can serve as incident evidence only when their device and time scopes match the case.
FortiAnalyzer report configuration and scheduler operation are distinct from layout design. That principle matters when a security officer requests a weekly report, but the administrator creates a correct report definition and never schedules it. It is not the mechanism explaining the selected response to the present facts. Reports can serve as incident evidence only when their device and time scopes match the case.
The FortiAnalyzer investigation reports: A report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. Which response is most appropriate?
Choose supported product log sources or normalized common fields and create separate charts when necessary. In this case, A report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. The product behavior is: FortiAnalyzer datasets require compatible device log types and valid projected field mappings. Confirm the remedy with this result: Each product's relevant results appear without inventing absent raw fields.
Check Analytics SQL insertion, date filtering and ADOM log retention instead of blaming the report renderer. That action applies when a monthly report contains no data although matching events are visible in Log View's real-time display. It does not resolve the current source condition: A report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. The relevant correction is: Choose supported product log sources or normalized common fields and create separate charts when necessary.
Revise dataset projections to aggregate or pseudonymize identities before distributing the report. That action applies when a junior analyst builds a custom report with confidential usernames in every chart although the audience requires only totals. It does not resolve the current source condition: A report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. The relevant correction is: Choose supported product log sources or normalized common fields and create separate charts when necessary.
Configure the intended report run schedule, date period, and delivery destination with a test execution. That action applies when a security officer requests a weekly report, but the administrator creates a correct report definition and never schedules it. It does not resolve the current source condition: A report chart combines FortiGate and FortiMail events but uses fields present only in FortiGate traffic logs. The relevant correction is: Choose supported product log sources or normalized common fields and create separate charts when necessary.
A FortiAnalyzer 7.6 analyst finds: An analyst creates a custom chart without first defining a dataset for its source fields. Which corrective response best addresses the issue?
Create or select a compatible dataset, then bind the chart to that dataset and its output columns. In this case, an analyst creates a custom chart without first defining a dataset for its source fields. The product behavior is: FortiAnalyzer charts reference datasets that query the SQL Analytics database. Confirm the remedy with this result: The chart preview shows the expected values and is available for insertion into the report.
Export the supported report and dependent charts or datasets through their relevant product workflows. That action applies when a custom report must be reused after FortiAnalyzer replacement, but the team exports only a screenshot of its layout. It does not resolve the current source condition: An analyst creates a custom chart without first defining a dataset for its source fields. The relevant correction is: Create or select a compatible dataset, then bind the chart to that dataset and its output columns.
Use a suitable dataset-backed macro or scalar report element representing the intended measured value. That action applies when an executive report needs one text value showing the highest-risk source, but the engineer inserts a large unfiltered traffic table. It does not resolve the current source condition: An analyst creates a custom chart without first defining a dataset for its source fields. The relevant correction is: Create or select a compatible dataset, then bind the chart to that dataset and its output columns.
Stop delivery, inspect dataset scope and source-device filters, then regenerate under the intended tenant. That action applies when a customer report unexpectedly contains data from another ADOM following a copy-and-paste template operation. It does not resolve the current source condition: An analyst creates a custom chart without first defining a dataset for its source fields. The relevant correction is: Create or select a compatible dataset, then bind the chart to that dataset and its output columns.
A security operations review identifies: An administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. What action should the analyst take first?
Review the effective ADOM storage policy and communicate any impact on existing indexed data before applying changes. In this case, an administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. The product behavior is: FortiAnalyzer data policies govern SQL Analytics age and Archive age separately. Confirm the remedy with this result: Retention checks show the required records in their intended Analytics and Archive lifecycle states.
Inspect enabled FortiGate security features and selected logging categories, then validate a safe detection test. That action applies when a device sends system-event logs but no security-profile logs, and a manager assumes FortiAnalyzer automatically enriches missing signatures. It does not resolve the current source condition: An administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. The relevant correction is: Review the effective ADOM storage policy and communicate any impact on existing indexed data before applying changes.
Correct supported log type or subtype mapping and test it against known web-filter records. That action applies when a parser assigns a web-filter log to a generic traffic subtype so category-specific threat views show no events. It does not resolve the current source condition: An administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. The relevant correction is: Review the effective ADOM storage policy and communicate any impact on existing indexed data before applying changes.
Select the authorized ADOM containing the affected devices and verify indicator and incident scope. That action applies when a dashboard widget reports zero indicators after the analyst selects a different ADOM than the one containing the incident. It does not resolve the current source condition: An administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. The relevant correction is: Review the effective ADOM storage policy and communicate any impact on existing indexed data before applying changes.
The team proposes leaving this condition in place: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. Which resulting risk is most relevant?
A valid report in one ADOM may not be accessible to a task operating in another. The exposure is present because A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. FortiAnalyzer behavior explains why: FortiAnalyzer reports and automation tasks must share a compatible administrative domain and authorization scope. The corrective approach is: Check task report identity, triggering ADOM and permissions, then bind the correct scoped report.
A disconnected variable reference can cause silent blank parameters or task failures. Such a failure could arise when the SOC changes a playbook variable name but leaves downstream task mappings referencing its former name. Here the stated problem is specifically: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. Its direct exposure is: A valid report in one ADOM may not be accessible to a task operating in another.
Incorrect variable wiring in a write action can corrupt unrelated investigation history. Such a failure could arise when a playbook task passes an incident identifier in the wrong field to Update Incident and changes an unrelated case. Here the stated problem is specifically: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. Its direct exposure is: A valid report in one ADOM may not be accessible to a task operating in another.
A rule cannot detect log conditions that never arrive or are not processed into its evaluated source. Such a failure could arise when an analyst edits an event-handler condition and assumes it is working without confirming new log records are indexed. Here the stated problem is specifically: A response playbook's report task works when run manually but fails when started by an incident trigger with a different ADOM. Its direct exposure is: A valid report in one ADOM may not be accessible to a task operating in another.
The FortiAnalyzer investigation reports: An analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. Which response is most appropriate?
Wait for supported enrichment results, assess confidence and save the reviewed enrichment context. In this case, an analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. The product behavior is: FortiAnalyzer indicator enrichment has an explicit review and save step for supported threat context. Confirm the remedy with this result: The incident retains the verified reputation details and investigation notes distinguish them from analyst assumptions.
Apply supported identity or grouping criteria so correlated source evidence belongs to the same intended endpoint. That action applies when a correlation rule detects suspicious DNS and IPS records but the team has not verified they refer to the same host. It does not resolve the current source condition: An analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. The relevant correction is: Wait for supported enrichment results, assess confidence and save the reviewed enrichment context.
Check connector and target outcome, then document verification before setting final incident disposition. That action applies when a SOC shift closes an incident as remediated after a playbook command is sent but before endpoint response is confirmed. It does not resolve the current source condition: An analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. The relevant correction is: Wait for supported enrichment results, assess confidence and save the reviewed enrichment context.
Choose grouping fields and supported original-client context that identify distinct relevant sources. That action applies when an event handler uses a source IP grouping key, but all translated clients appear as a single NAT gateway. It does not resolve the current source condition: An analyst runs indicator enrichment and immediately classifies a suspicious domain as malicious before the enrichment results are saved. The relevant correction is: Wait for supported enrichment results, assess confidence and save the reviewed enrichment context.
A SOC manager discovers: During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. Which exposure deserves attention?
Overbroad domain indicators can overcount benign activity and obscure the targeted malicious URL. The exposure is present because During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. FortiAnalyzer behavior explains why: Log indicators have different granularities and should preserve available message and URL context. The corrective approach is: Preserve the precise indicator form and related user, sender, recipient and message context where logged.
New log source registration does not guarantee existing reports include the device in their scope. Such a failure could arise when a manager complains a report omits a new branch although its FortiGate is now authorized and sending logs. Here the stated problem is specifically: During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. Its direct exposure is: Overbroad domain indicators can overcount benign activity and obscure the targeted malicious URL.
Timezone mismatch can shift the chosen search window away from the actual suspicious activity. Such a failure could arise when a suspected lateral-movement timeline starts at midnight UTC, yet the response shift uses the local appliance timezone. Here the stated problem is specifically: During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. Its direct exposure is: Overbroad domain indicators can overcount benign activity and obscure the targeted malicious URL.
Repeated presentations of the same event population can exaggerate perceived independent evidence. Such a failure could arise when a custom dashboard layout shows many duplicate widgets and the incident team mistakenly treats them as independent alerts. Here the stated problem is specifically: During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. Its direct exposure is: Overbroad domain indicators can overcount benign activity and obscure the targeted malicious URL.
The team proposes leaving this condition in place: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. Which resulting risk is most relevant?
Archive retention by itself does not guarantee that historical records remain indexed for normal report queries. The exposure is present because Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. FortiAnalyzer behavior explains why: FortiAnalyzer distinguishes searchable Analytics records from retained Archive files under ADOM storage policies. The corrective approach is: Set feasible Analytics and Archive retention policies based on approved storage capacity and reporting needs.
Single-device traffic utilization can obscure multi-source threat patterns and incident correlations. Such a failure could arise when a security team wants to recognize a regional attack spike but looks only at one device's interface traffic totals. Here the stated problem is specifically: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. Its direct exposure is: Archive retention by itself does not guarantee that historical records remain indexed for normal report queries.
A field-name migration can make a working ingestion pipeline look empty to legacy searches. Such a failure could arise when the SOC compares new 7.6 log fields with a legacy saved filter and assumes blank values mean no suspicious activity. Here the stated problem is specifically: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. Its direct exposure is: Archive retention by itself does not guarantee that historical records remain indexed for normal report queries.
ADOM migrations can interrupt monitoring or expose the wrong dataset when dependent objects are not reviewed. Such a failure could arise when an MSSP moves one FortiGate from an initial onboarding ADOM into a production ADOM without reviewing downstream dashboards. Here the stated problem is specifically: Security reporting requires historical analysis for six months, but the ADOM policy retains SQL analytics data for only thirty days. Its direct exposure is: Archive retention by itself does not guarantee that historical records remain indexed for normal report queries.
A security operations review identifies: A FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. What action should the analyst take first?
Drill into underlying sessions and original client mappings where available before identifying individual users. In this case, A FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. The product behavior is: FortiView source summaries aggregate logs by the selected source field and do not reconstruct every upstream identity automatically. Confirm the remedy with this result: Per-client findings are linked to the source records rather than assigned indiscriminately to the proxy.
Inspect the empty chart's dataset, log type and filters independently of the populated chart. That action applies when a report contains a chart with zero rows even though a different chart on the same page is populated. It does not resolve the current source condition: A FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. The relevant correction is: Drill into underlying sessions and original client mappings where available before identifying individual users.
Check Analytics retention, SQL insertion and the report's selected time interval before changing the layout. That action applies when a scheduled compliance report is blank for one day although Log View shows Archive records from that date. It does not resolve the current source condition: A FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. The relevant correction is: Drill into underlying sessions and original client mappings where available before identifying individual users.
Standardize action, category and time predicates across the selected FortiView views. That action applies when a SOC wants to compare policy-based blocked traffic across several devices but uses different application filters for each widget. It does not resolve the current source condition: A FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. The relevant correction is: Drill into underlying sessions and original client mappings where available before identifying individual users.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
