Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Test individual chart queries before publishing complex report templates”, reduces a different source-defined risk: An analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. That risk depends on: Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability. The recurring problem here is a scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. The originally selected control “Check source ingestion and Analytics availability before diagnosing blank reports” is more specific because report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports.

This safeguard, “Specify expected analytics-to-report latency in SOC performance targets”, reduces a different source-defined risk: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. That risk depends on: Live or summarized views and scheduled report generation may consume data on different schedules. The recurring problem here is a scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. The originally selected control “Check source ingestion and Analytics availability before diagnosing blank reports” is more specific because report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports.

This safeguard, “Cross-check log type, timeframe, and device scope during blank-report triage”, reduces a different source-defined risk: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. That risk depends on: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. The recurring problem here is a scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. The originally selected control “Check source ingestion and Analytics availability before diagnosing blank reports” is more specific because report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports.

The action “Run dataset Validate or Analyze Query and correct the table and field references to the selected log type” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The original answer “Inspect report time period and scheduled run parameters against the business-requested interval” targets that failure because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The action “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” addresses a separate source case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its underlying reason is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. This question instead describes a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The original answer “Inspect report time period and scheduled run parameters against the business-requested interval” targets that failure because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The action “Inspect which report sections and charts are enabled before troubleshooting SQL or log collection” addresses a separate source case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its underlying reason is: Report layout and section selection determine which otherwise valid chart objects are included in output. This question instead describes a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The original answer “Inspect report time period and scheduled run parameters against the business-requested interval” targets that failure because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The action “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” addresses a separate source case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its underlying reason is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. This question instead describes a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The original answer “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” targets that failure because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The original answer “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” targets that failure because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The action “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The original answer “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” targets that failure because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The proposed observation “The intended FortiGate serial contributes its test record after filter correction” would check a different original case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its mechanism is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. In the present case, a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning; the more direct acceptance evidence is “A rerun restricted to yesterday contains only relevant event timestamps” because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The proposed observation “The completed report is delivered to the approved test mailbox while its content remains unchanged” would check a different original case: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. Its mechanism is: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. In the present case, a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning; the more direct acceptance evidence is “A rerun restricted to yesterday contains only relevant event timestamps” because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The proposed observation “A later successful report aligns its count to the appropriate completed indexing window” would check a different original case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its mechanism is: Live or summarized views and scheduled report generation may consume data on different schedules. In the present case, a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning; the more direct acceptance evidence is “A rerun restricted to yesterday contains only relevant event timestamps” because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

This safeguard, “Check source ingestion and Analytics availability before diagnosing blank reports”, reduces a different source-defined risk: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. That risk depends on: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. The recurring problem here is a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The originally selected control “Require explicit report-period confirmation in analyst review checklists” is more specific because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

This safeguard, “Use dependency inventories when deleting or renaming report datasets”, reduces a different source-defined risk: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. That risk depends on: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. The recurring problem here is a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The originally selected control “Require explicit report-period confirmation in analyst review checklists” is more specific because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

This safeguard, “Define metric semantics for counts, distinct entities, and sessions in report specifications”, reduces a different source-defined risk: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. That risk depends on: A count of events is not a count of unique principals unless the query groups or deduplicates identities. The recurring problem here is a report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. The originally selected control “Require explicit report-period confirmation in analyst review checklists” is more specific because report query time scope determines which historical logs enter dataset results, independent of visual chart selection.

The action “Validate the failing chart's dataset and its selected security log type separately from the healthy charts” addresses a separate source case: An analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. Its underlying reason is: Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability. This question instead describes a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The original answer “Verify the report's current ADOM and permitted device selection before interpreting its metrics” targets that failure because aDOM-specific reports and source selection govern which managed devices contribute data.

The action “Investigate the output profile's mail destination and delivery configuration rather than regenerating the report contents” addresses a separate source case: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. Its underlying reason is: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. This question instead describes a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The original answer “Verify the report's current ADOM and permitted device selection before interpreting its metrics” targets that failure because aDOM-specific reports and source selection govern which managed devices contribute data.

The action “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” addresses a separate source case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its underlying reason is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. This question instead describes a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The original answer “Verify the report's current ADOM and permitted device selection before interpreting its metrics” targets that failure because aDOM-specific reports and source selection govern which managed devices contribute data.

The action “Report layout and section selection determine which otherwise valid chart objects are included in output” addresses a separate source case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its underlying reason is: Report layout and section selection determine which otherwise valid chart objects are included in output. This question instead describes a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The original answer “ADOM-specific reports and source selection govern which managed devices contribute data” targets that failure because aDOM-specific reports and source selection govern which managed devices contribute data.

The action “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The original answer “ADOM-specific reports and source selection govern which managed devices contribute data” targets that failure because aDOM-specific reports and source selection govern which managed devices contribute data.

The action “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The original answer “ADOM-specific reports and source selection govern which managed devices contribute data” targets that failure because aDOM-specific reports and source selection govern which managed devices contribute data.

The proposed observation “Two sessions by one test user count as one unique user in the corrected report” would check a different original case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its mechanism is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. In the present case, a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs; the more direct acceptance evidence is “The corrected report uses only the intended tenant's logging sources” because aDOM-specific reports and source selection govern which managed devices contribute data.

The proposed observation “Matching records are present in FortiAnalyzer Analytics and the rerun report includes expected traffic” would check a different original case: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. Its mechanism is: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. In the present case, a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs; the more direct acceptance evidence is “The corrected report uses only the intended tenant's logging sources” because aDOM-specific reports and source selection govern which managed devices contribute data.

The proposed observation “The completed report is delivered to the approved test mailbox while its content remains unchanged” would check a different original case: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. Its mechanism is: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. In the present case, a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs; the more direct acceptance evidence is “The corrected report uses only the intended tenant's logging sources” because aDOM-specific reports and source selection govern which managed devices contribute data.

This safeguard, “Plan report concurrency and monitor queue depth for heavy reporting windows”, reduces a different source-defined risk: A report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. That risk depends on: Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog. The recurring problem here is a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The originally selected control “Recheck ADOM and device filters when reusing report templates” is more specific because aDOM-specific reports and source selection govern which managed devices contribute data.

This safeguard, “Cross-check log type, timeframe, and device scope during blank-report triage”, reduces a different source-defined risk: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. That risk depends on: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. The recurring problem here is a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The originally selected control “Recheck ADOM and device filters when reusing report templates” is more specific because aDOM-specific reports and source selection govern which managed devices contribute data.

This safeguard, “Check source ingestion and Analytics availability before diagnosing blank reports”, reduces a different source-defined risk: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. That risk depends on: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. The recurring problem here is a report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. The originally selected control “Recheck ADOM and device filters when reusing report templates” is more specific because aDOM-specific reports and source selection govern which managed devices contribute data.

The action “Investigate the output profile's mail destination and delivery configuration rather than regenerating the report contents” addresses a separate source case: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. Its underlying reason is: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Assess whether the ADOM and dataset support the FortiMail log type or require an appropriate Fabric ADOM” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “Inspect which report sections and charts are enabled before troubleshooting SQL or log collection” addresses a separate source case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its underlying reason is: Report layout and section selection determine which otherwise valid chart objects are included in output. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Assess whether the ADOM and dataset support the FortiMail log type or require an appropriate Fabric ADOM” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “Verify the dataset log subtype matches the actual security records and align the report time window” addresses a separate source case: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. Its underlying reason is: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Assess whether the ADOM and dataset support the FortiMail log type or require an appropriate Fabric ADOM” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.