The refreshed output includes recently indexed representative records without relying on stale cached results. That outcome would be relevant when a report shows stale counts after an analyst assumes a cached preview was regenerated with every new log. The decisive evidence is: The incident note distinguishes an attempted request from confirmed successful destination access.

The investigation matches the intended campaign without accidentally including unrelated visits to the same domain. That outcome would be relevant when During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. The decisive evidence is: The incident note distinguishes an attempted request from confirmed successful destination access.

Recognized application events populate the widget after a controlled approved test. That outcome would be relevant when a Top Applications widget appears empty after a FortiGate configuration disables application-control logging while traffic logs continue. The decisive evidence is: The incident note distinguishes an attempted request from confirmed successful destination access.

Distinguish collection time from Analytics database ingestion and run the report after required indexing completes. That action applies when a real-time log search shows a new IPS detection but a report scheduled seconds earlier excludes that detection. It does not resolve the current source condition: An incident dashboard changes from High to Critical counts after an analyst widens the global time filter, and the team calls it a new outbreak. The relevant correction is: Reapply an explicit time range and check newly created incident timestamps before declaring a surge.

Drill into outbreak events and associated incidents, then verify actual response actions per affected host. That action applies when an analyst sees an outbreak alert counter increase and treats it as proof that all infected hosts have already been contained. It does not resolve the current source condition: An incident dashboard changes from High to Critical counts after an analyst widens the global time filter, and the team calls it a new outbreak. The relevant correction is: Reapply an explicit time range and check newly created incident timestamps before declaring a surge.

Verify log insertion status and SQL indexing or reconstruction health before editing the report layout. That action applies when a newly received FortiGate log appears in raw form but has not yet appeared in a SQL-driven analytics report. It does not resolve the current source condition: An incident dashboard changes from High to Critical counts after an analyst widens the global time filter, and the team calls it a new outbreak. The relevant correction is: Reapply an explicit time range and check newly created incident timestamps before declaring a surge.

Validate the FortiAnalyzer log reception path and permit only the supported logging transport and peer identities. That action applies when a site sends encrypted Fortinet log traffic through a firewall that allows HTTPS management but blocks the configured log transport. It does not resolve the current source condition: A branch FortiGate points its remote logging destination at FortiAnalyzer, but the analyst cannot find any device in Device Manager. The relevant correction is: Authorize the FortiGate in the intended ADOM and verify its logging destination and connectivity.

Review the effective ADOM storage policy and communicate any impact on existing indexed data before applying changes. That action applies when an administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. It does not resolve the current source condition: A branch FortiGate points its remote logging destination at FortiAnalyzer, but the analyst cannot find any device in Device Manager. The relevant correction is: Authorize the FortiGate in the intended ADOM and verify its logging destination and connectivity.

Verify log insertion status and SQL indexing or reconstruction health before editing the report layout. That action applies when a newly received FortiGate log appears in raw form but has not yet appeared in a SQL-driven analytics report. It does not resolve the current source condition: A branch FortiGate points its remote logging destination at FortiAnalyzer, but the analyst cannot find any device in Device Manager. The relevant correction is: Authorize the FortiGate in the intended ADOM and verify its logging destination and connectivity.

Central log aggregation improves visibility but does not automatically deliver fault-tolerant source log preservation. That principle matters when After enabling centralized logging, the security team disables all local FortiGate logging and assumes FortiAnalyzer remains reachable during disasters. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer report datasets query eligible indexed Analytics logs rather than every unprocessed inbound record.

ADOMs separate FortiAnalyzer device management and analytical views within assigned administrator permissions. That principle matters when a managed service provider must separate customer log visibility, but all analysts currently use one unrestricted FortiAnalyzer administrator account. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer report datasets query eligible indexed Analytics logs rather than every unprocessed inbound record.

FortiAnalyzer data policies govern SQL Analytics age and Archive age separately. That principle matters when an administrator changes Analytics retention and assumes the older SQL rows will remain indefinitely because Archive is configured. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer report datasets query eligible indexed Analytics logs rather than every unprocessed inbound record.

The totals reconcile after both analysts use an explicitly authorized equivalent scope. That outcome would be relevant when Two analysts compare a saved FortiView filter but their ADOM permissions yield different devices and apparently inconsistent totals. The decisive evidence is: The estimated transfer amount excludes duplicated records and states measurement uncertainty.

The investigation matches the intended campaign without accidentally including unrelated visits to the same domain. That outcome would be relevant when During phishing triage, an investigator copies a domain from an email-filter alert but omits its URL path and user identity. The decisive evidence is: The estimated transfer amount excludes duplicated records and states measurement uncertainty.

The handoff reports separate counts for detected events and active incident records. That outcome would be relevant when a SOC dashboard counts several high-severity events but the team interprets that as the number of open incidents. The decisive evidence is: The estimated transfer amount excludes duplicated records and states measurement uncertainty.

Incident management captures operational ownership and status beyond event generation. That principle matters when a high-severity incident has several events but no assigned owner, and both shifts assume the other is handling it. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer predefined handlers can be cloned and customized for local detection requirements.

Event notifications distribute sensitive detection content independently of ADOM screen restrictions. That principle matters when the SOC adds a custom handler with an email notification recipient outside the designated customer tenant. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer predefined handlers can be cloned and customized for local detection requirements.

FortiAnalyzer playbook management is controlled by administrator profile permissions for Incidents and Events. That principle matters when a security engineer creates a playbook but cannot edit or run it due to read-only Incidents and Events access. It is not the mechanism explaining the selected response to the present facts. FortiAnalyzer predefined handlers can be cloned and customized for local detection requirements.

Report availability depends on indexed log retention as well as query and chart configuration. That principle matters when a historical report never finishes because the selected retention period is longer than the SQL Analytics window and expensive reconstruction is unplanned. It is not the mechanism explaining the selected response to the present facts. FortiView rankings describe observed activity and require environmental context for interpretation.

FortiAnalyzer charts depend on datasets as explicit data-source references. That principle matters when a chart fails to display after the analyst deletes a custom dataset that the chart still references. It is not the mechanism explaining the selected response to the present facts. FortiView rankings describe observed activity and require environmental context for interpretation.

FortiView visualization results are contextual aggregates requiring filter and time metadata. That principle matters when an analyst presents a FortiView chart screenshot without its ADOM or query window and management compares it with a later chart. It is not the mechanism explaining the selected response to the present facts. FortiView rankings describe observed activity and require environmental context for interpretation.

The completion record distinguishes which tasks succeeded, failed or were never reached. That outcome would be relevant when a playbook writes an incident note successfully but the team assumes all following connector calls must also have succeeded. The decisive evidence is: The case records whether the address is an authorized scanner or requires a targeted response.

The case uses internal log context for private addresses and valid public indicators for enrichment. That outcome would be relevant when a threat analyst creates an IP indicator using a private RFC1918 address and expects external reputation enrichment to score it globally. The decisive evidence is: The case records whether the address is an authorized scanner or requires a targeted response.

New events use the intended severity while historical case changes are deliberate and audited. That outcome would be relevant when an operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. The decisive evidence is: The case records whether the address is an authorized scanner or requires a targeted response.

FortiView geographic maps summarize selected log dimensions without proving common adversary control. That principle matters when a geo map widget plots many connections from one cloud provider country and analysts attribute all connections to one attacker. It is not the mechanism explaining the selected response to the present facts. Log-derived events require source-specific context in addition to a matched detection signature.

IP geolocation is derived context and does not by itself establish a user's physical location. That principle matters when a report of impossible travel uses geographic IP lookup but the user connects through a corporate VPN egress in another country. It is not the mechanism explaining the selected response to the present facts. Log-derived events require source-specific context in addition to a matched detection signature.

Dashboard widgets can reuse the same underlying dataset and should not be counted as distinct detections. That principle matters when a custom dashboard layout shows many duplicate widgets and the incident team mistakenly treats them as independent alerts. It is not the mechanism explaining the selected response to the present facts. Log-derived events require source-specific context in addition to a matched detection signature.

Event handler configuration affects new matches and is separate from incident history and disposition. That principle matters when an operator changes the severity of a custom handler expecting older incidents to change their historical severities automatically. It is not the mechanism explaining the selected response to the present facts. Event messages can expose selected log attributes needed to contextualize correlated detections.

FortiAnalyzer FortiOS connector routing may use the device serial identifier passed into the task. That principle matters when a FortiGate group has three devices sharing a webhook action name, and the playbook blocks an IP on the wrong firewall. It is not the mechanism explaining the selected response to the present facts. Event messages can expose selected log attributes needed to contextualize correlated detections.

FortiAnalyzer manages typed IP, URL and domain indicators as distinct SOC objects. That principle matters when a newly discovered malicious URL is entered only as a note in an incident rather than a typed indicator. It is not the mechanism explaining the selected response to the present facts. Event messages can expose selected log attributes needed to contextualize correlated detections.

Inspect Analytics insertion backlog, database capacity and device reception separately before adjusting network routes. That action applies when the SQL database is nearly full after a traffic surge, but the team diagnoses a broken FortiGate transport because report data is late. It does not resolve the current source condition: A SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. The relevant correction is: Use indicator enrichment for threat context and correlate matching original logs for packet or session evidence.

Use relevant SOC and FortiView threat widgets scoped to the full permitted Fabric and time interval. That action applies when a security team wants to recognize a regional attack spike but looks only at one device's interface traffic totals. It does not resolve the current source condition: A SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. The relevant correction is: Use indicator enrichment for threat context and correlate matching original logs for packet or session evidence.

Enable suitable ADOMs and scope administrator profiles to permitted customer ADOMs and device groups. That action applies when a managed service provider must separate customer log visibility, but all analysts currently use one unrestricted FortiAnalyzer administrator account. It does not resolve the current source condition: A SOC engineer opens the indicators chart and assumes a reputation visualization provides historical packet captures. The relevant correction is: Use indicator enrichment for threat context and correlate matching original logs for packet or session evidence.