The short spike is visible and the supporting sessions are tied to distinct sources and destinations. That outcome would be relevant when a dashboard uses daily averages and hides a ten-minute spike in outbound sessions during an incident. The decisive evidence is: The failure sequence and any subsequent successful login appear in one traceable chronological view.

An independent test event aligns the event occurrence with the expected normalized timestamp. That outcome would be relevant when a device's current time is wrong by an hour after a daylight-saving transition, but SOC staff assume all displayed events are delayed. The decisive evidence is: The failure sequence and any subsequent successful login appear in one traceable chronological view.

The branch contributes its expected rows without exposing other tenants. That outcome would be relevant when a manager complains a report omits a new branch although its FortiGate is now authorized and sending logs. The decisive evidence is: The failure sequence and any subsequent successful login appear in one traceable chronological view.

Check raw action values and use a validated matching expression covering the intended normalized action set. That action applies when a filter for denied traffic finds no data because source devices label actions with several supported drop and deny variants. It does not resolve the current source condition: Two FortiGates share an administrator naming convention, and operators accidentally merge their traffic conclusions into one device identity. The relevant correction is: Match device serial identifiers to inventory records and select the appropriate device when filtering collected logs.

Inspect Analytics insertion backlog, database capacity and device reception separately before adjusting network routes. That action applies when the SQL database is nearly full after a traffic surge, but the team diagnoses a broken FortiGate transport because report data is late. It does not resolve the current source condition: Two FortiGates share an administrator naming convention, and operators accidentally merge their traffic conclusions into one device identity. The relevant correction is: Match device serial identifiers to inventory records and select the appropriate device when filtering collected logs.

Register and authorize the replacement serial and update authorized device selections in reports and searches. That action applies when After a firewall replacement, a FortiGate has a different serial number while the old device record remains authorized in FortiAnalyzer. It does not resolve the current source condition: Two FortiGates share an administrator naming convention, and operators accidentally merge their traffic conclusions into one device identity. The relevant correction is: Match device serial identifiers to inventory records and select the appropriate device when filtering collected logs.

Event creation does not automatically configure or guarantee outbound email delivery. Such a failure could arise when a predefined IPS event handler matches suspicious traffic, but notifications never reach the SOC mailbox. Here the stated problem is specifically: Two analysts investigate the same phishing indicator in different incidents and independently attempt host containment. Its direct exposure is: Duplicate response efforts can interrupt services and complicate the incident timeline.

Case count can undercount or overcount affected systems when event grouping differs. Such a failure could arise when Several alert events are grouped into one incident, and analysts use the incident count as the number of distinct infected endpoints. Here the stated problem is specifically: Two analysts investigate the same phishing indicator in different incidents and independently attempt host containment. Its direct exposure is: Duplicate response efforts can interrupt services and complicate the incident timeline.

Filtering the wrong log category can silently suppress critical detections. Such a failure could arise when an event handler is configured to detect malware quarantine, but its filter searches generic traffic logs instead of antivirus records. Here the stated problem is specifically: Two analysts investigate the same phishing indicator in different incidents and independently attempt host containment. Its direct exposure is: Duplicate response efforts can interrupt services and complicate the incident timeline.

Scope the analyst's role and ADOM to authorized reporting objects and use delegated controls. That action applies when an administrator gives a customer analyst unrestricted access to all report definitions so they can edit one custom report. It does not resolve the current source condition: A SOC report needs one new custom chart, but an engineer overwrites a built-in chart shared by other reports. The relevant correction is: Clone the existing chart or create a custom chart and insert it only into the intended report.

Profile and narrow the SQL dataset by intended log type, join keys, source devices and time range. That action applies when a report takes too long to render because a custom dataset performs an unrestricted join across high-volume traffic and IPS tables. It does not resolve the current source condition: A SOC report needs one new custom chart, but an engineer overwrites a built-in chart shared by other reports. The relevant correction is: Clone the existing chart or create a custom chart and insert it only into the intended report.

Verify the report output path and write entitlement with the intended restricted service identity. That action applies when a report scheduling task fails after the service account loses permission to the destination folder or remote storage. It does not resolve the current source condition: A SOC report needs one new custom chart, but an engineer overwrites a built-in chart shared by other reports. The relevant correction is: Clone the existing chart or create a custom chart and insert it only into the intended report.

Add explicit validation of required indicator type and non-empty value before the write-capable task. That action applies when a playbook's indicator lookup task returns an empty value but the following IP-block action still sends an API request. It does not resolve the current source condition: An event-triggered playbook never executes even though the matching event appears in Event Monitor. The relevant correction is: Inspect playbook enabled state, trigger type, filter conditions and execution task history.

Supply a validated target device ID and check the matching connector action's device scope. That action applies when a FortiGate group has three devices sharing a webhook action name, and the playbook blocks an IP on the wrong firewall. It does not resolve the current source condition: An event-triggered playbook never executes even though the matching event appears in Event Monitor. The relevant correction is: Inspect playbook enabled state, trigger type, filter conditions and execution task history.

Create a supported URL indicator, associate it with the incident and perform justified enrichment. That action applies when a newly discovered malicious URL is entered only as a note in an incident rather than a typed indicator. It does not resolve the current source condition: An event-triggered playbook never executes even though the matching event appears in Event Monitor. The relevant correction is: Inspect playbook enabled state, trigger type, filter conditions and execution task history.

Inspect report cache policy and force an appropriate regeneration or refresh under current data. That action applies when a report shows stale counts after an analyst assumes a cached preview was regenerated with every new log. It does not resolve the current source condition: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. The relevant correction is: Use the dataset log-type selector appropriate to the actual device and ADOM before testing the query.

Compare event status with new matching log arrivals and the last verified enforcement action. That action applies when an incident handler marks an event mitigated, and a different analyst assumes no further malicious attempts have occurred. It does not resolve the current source condition: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. The relevant correction is: Use the dataset log-type selector appropriate to the actual device and ADOM before testing the query.

Drill into underlying sessions and original client mappings where available before identifying individual users. That action applies when a FortiView Top Sources widget shows high traffic from an internal caching proxy, but analysts assume that proxy generated every original request. It does not resolve the current source condition: An analyst tests an SQL dataset with a FortiGate log type but expects antivirus events from a non-FortiGate Fabric device. The relevant correction is: Use the dataset log-type selector appropriate to the actual device and ADOM before testing the query.

Create or apply the rule within the authorized ADOM that contains those device logs. That action applies when an analyst enables a high-severity event handler but forgets the source devices are in a different ADOM. It does not resolve the current source condition: A playbook template is enabled without reviewing its assigned active connector and attempts to operate on a production firewall unexpectedly. The relevant correction is: Clone or inspect the template, restrict its trigger and target connector, then conduct a non-destructive trial.

Review imported connectors, trigger conditions and target identity before enabling the playbook in production. That action applies when an automation playbook is imported from a lab but includes connectors that point to test endpoints. It does not resolve the current source condition: A playbook template is enabled without reviewing its assigned active connector and attempts to operate on a production firewall unexpectedly. The relevant correction is: Clone or inspect the template, restrict its trigger and target connector, then conduct a non-destructive trial.

Review relevant built-in handler rules and create a supported customized handler for the new signature scope. That action applies when a SOC manager wants to monitor a newly defined outbreak pattern but uses an outdated built-in handler whose rule list never includes it. It does not resolve the current source condition: A playbook template is enabled without reviewing its assigned active connector and attempts to operate on a production firewall unexpectedly. The relevant correction is: Clone or inspect the template, restrict its trigger and target connector, then conduct a non-destructive trial.

The final dashboard shows one clearly labeled indicator per unique signal and supporting log population. That outcome would be relevant when a custom dashboard layout shows many duplicate widgets and the incident team mistakenly treats them as independent alerts. The decisive evidence is: Per-client findings are linked to the source records rather than assigned indiscriminately to the proxy.

A sample report finishes within its target window without changing its legitimate required totals. That outcome would be relevant when a high-volume daily report takes far longer than expected after an analyst removes all date and device filters from a custom dataset. The decisive evidence is: Per-client findings are linked to the source records rather than assigned indiscriminately to the proxy.

The incident note distinguishes an attempted request from confirmed successful destination access. That outcome would be relevant when a blocked malicious URL appears in a web-filter log, and the incident owner claims that the destination was reached. The decisive evidence is: Per-client findings are linked to the source records rather than assigned indiscriminately to the proxy.

Adjust report editor element placement and widths, then regenerate the intended output format. That action applies when an executive dashboard report looks correct in preview but the generated PDF has clipped charts on one page. It does not resolve the current source condition: An analyst creates a macro labeled total unique users, but its dataset counts all login records including duplicates. The relevant correction is: Use an appropriate distinct-user calculation and validate against a small known event sample.

Compare source event times, query timezone and report interval boundaries before changing retention. That action applies when an auditor complains that a report omits the final hour of a reporting day, and administrators assume the missing log records were deleted. It does not resolve the current source condition: An analyst creates a macro labeled total unique users, but its dataset counts all login records including duplicates. The relevant correction is: Use an appropriate distinct-user calculation and validate against a small known event sample.

Clone the predefined dataset and make authorized custom changes against the copied definition. That action applies when a chart with a predefined dataset is copied into a customer template, but the analyst expects to edit the built-in dataset in place. It does not resolve the current source condition: An analyst creates a macro labeled total unique users, but its dataset counts all login records including duplicates. The relevant correction is: Use an appropriate distinct-user calculation and validate against a small known event sample.

The corrected test passes expected indicator and incident identifiers between connected tasks. That outcome would be relevant when the SOC changes a playbook variable name but leaves downstream task mappings referencing its former name. The decisive evidence is: The automation runs only when its configured trigger occurs and monitoring records that trigger.

Separate clients no longer combine into a false multi-attempt pattern at one gateway address. That outcome would be relevant when an event handler uses a source IP grouping key, but all translated clients appear as a single NAT gateway. The decisive evidence is: The automation runs only when its configured trigger occurs and monitoring records that trigger.

A synthetic case produces a ticket through the expected connector without granting broad rights. That outcome would be relevant when a playbook uses an external ticketing connector but its credentials have expired after a password rotation. The decisive evidence is: The automation runs only when its configured trigger occurs and monitoring records that trigger.

Two test runs consistently include the intended daily or monthly periods. That outcome would be relevant when a report calendar entry launches at the expected time, but the incident summaries use the wrong timezone boundary. The decisive evidence is: The customer report uses the revised custom query without altering standard predefined content.

A test run includes precisely the required calendar dates, without current-month spillover. That outcome would be relevant when a regulatory report is supposed to include only prior calendar-month logs but uses an open-ended date range in the schedule. The decisive evidence is: The customer report uses the revised custom query without altering standard predefined content.

The macro reports unique affected identities rather than total login attempts. That outcome would be relevant when an analyst creates a macro labeled total unique users, but its dataset counts all login records including duplicates. The decisive evidence is: The customer report uses the revised custom query without altering standard predefined content.