Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The action “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The original answer “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” targets that failure because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The proposed observation “The corrected report uses only the intended tenant's logging sources” would check a different original case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its mechanism is: ADOM-specific reports and source selection govern which managed devices contribute data. In the present case, an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query; the more direct acceptance evidence is “A supported source scope and dataset return actual FortiMail records without inventing them” because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The proposed observation “The original task completes after capacity or scheduling remediation without duplicate overlapping jobs” would check a different original case: A report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. Its mechanism is: Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog. In the present case, an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query; the more direct acceptance evidence is “A supported source scope and dataset return actual FortiMail records without inventing them” because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The proposed observation “The next export visibly contains the intended chart with unchanged dataset rows” would check a different original case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its mechanism is: Report layout and section selection determine which otherwise valid chart objects are included in output. In the present case, an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query; the more direct acceptance evidence is “A supported source scope and dataset return actual FortiMail records without inventing them” because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

This safeguard, “Use dependency inventories when deleting or renaming report datasets”, reduces a different source-defined risk: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. That risk depends on: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. The recurring problem here is an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The originally selected control “Verify dataset source compatibility before promising multi-product analytics reports” is more specific because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

This safeguard, “Define metric semantics for counts, distinct entities, and sessions in report specifications”, reduces a different source-defined risk: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. That risk depends on: A count of events is not a count of unique principals unless the query groups or deduplicates identities. The recurring problem here is an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The originally selected control “Verify dataset source compatibility before promising multi-product analytics reports” is more specific because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

This safeguard, “Require explicit report-period confirmation in analyst review checklists”, reduces a different source-defined risk: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. That risk depends on: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. The recurring problem here is an intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. The originally selected control “Verify dataset source compatibility before promising multi-product analytics reports” is more specific because dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable.

The action “Verify the report's current ADOM and permitted device selection before interpreting its metrics” addresses a separate source case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its underlying reason is: ADOM-specific reports and source selection govern which managed devices contribute data. This question instead describes an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The original answer “Validate the failing chart's dataset and its selected security log type separately from the healthy charts” targets that failure because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The action “Verify the dataset log subtype matches the actual security records and align the report time window” addresses a separate source case: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. Its underlying reason is: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. This question instead describes an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The original answer “Validate the failing chart's dataset and its selected security log type separately from the healthy charts” targets that failure because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The action “Verify report scheduler timezone and source timestamps against the requested reporting boundary” addresses a separate source case: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. Its underlying reason is: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. This question instead describes an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The original answer “Validate the failing chart's dataset and its selected security log type separately from the healthy charts” targets that failure because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The action “Report device filters select specific logging sources; similar names do not guarantee matching source membership” addresses a separate source case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its underlying reason is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. This question instead describes an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The original answer “Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability” targets that failure because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The action “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The original answer “Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability” targets that failure because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The action “ADOM-specific reports and source selection govern which managed devices contribute data” addresses a separate source case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its underlying reason is: ADOM-specific reports and source selection govern which managed devices contribute data. This question instead describes an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The original answer “Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability” targets that failure because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The proposed observation “Sample normalized records restore expected group labels and the chart categories reappear” would check a different original case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its mechanism is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. In the present case, an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data; the more direct acceptance evidence is “A tested dataset produces threat rows and the corresponding chart renders in the next report run” because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The proposed observation “The required time-period data is available in the report's query source and counts become nonzero” would check a different original case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its mechanism is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. In the present case, an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data; the more direct acceptance evidence is “A tested dataset produces threat rows and the corresponding chart renders in the next report run” because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The proposed observation “The next export visibly contains the intended chart with unchanged dataset rows” would check a different original case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its mechanism is: Report layout and section selection determine which otherwise valid chart objects are included in output. In the present case, an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data; the more direct acceptance evidence is “A tested dataset produces threat rows and the corresponding chart renders in the next report run” because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

This safeguard, “Regression-test report grouping fields whenever parsers are updated”, reduces a different source-defined risk: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. That risk depends on: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. The recurring problem here is an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The originally selected control “Test individual chart queries before publishing complex report templates” is more specific because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

This safeguard, “Standardize reporting timezone conventions across distributed SOC teams”, reduces a different source-defined risk: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. That risk depends on: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. The recurring problem here is an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The originally selected control “Test individual chart queries before publishing complex report templates” is more specific because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

This safeguard, “Specify expected analytics-to-report latency in SOC performance targets”, reduces a different source-defined risk: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. That risk depends on: Live or summarized views and scheduled report generation may consume data on different schedules. The recurring problem here is an analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. The originally selected control “Test individual chart queries before publishing complex report templates” is more specific because each report chart can depend on a different query and log table, so one working chart does not establish another's data availability.

The action “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The original answer “Check Analytics retention and whether the relevant logs are available to the dataset instead of assuming an archive-only search populates charts” targets that failure because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The action “Verify the report's current ADOM and permitted device selection before interpreting its metrics” addresses a separate source case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its underlying reason is: ADOM-specific reports and source selection govern which managed devices contribute data. This question instead describes a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The original answer “Check Analytics retention and whether the relevant logs are available to the dataset instead of assuming an archive-only search populates charts” targets that failure because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The action “Inspect report time period and scheduled run parameters against the business-requested interval” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The original answer “Check Analytics retention and whether the relevant logs are available to the dataset instead of assuming an archive-only search populates charts” targets that failure because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The action “Report device filters select specific logging sources; similar names do not guarantee matching source membership” addresses a separate source case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its underlying reason is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. This question instead describes a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The original answer “Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets” targets that failure because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The action “Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients” addresses a separate source case: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. Its underlying reason is: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. This question instead describes a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The original answer “Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets” targets that failure because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The action “Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable” addresses a separate source case: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. Its underlying reason is: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. This question instead describes a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The original answer “Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets” targets that failure because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The proposed observation “Two sessions by one test user count as one unique user in the corrected report” would check a different original case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its mechanism is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. In the present case, a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period; the more direct acceptance evidence is “The required time-period data is available in the report's query source and counts become nonzero” because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The proposed observation “The corrected report uses only the intended tenant's logging sources” would check a different original case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its mechanism is: ADOM-specific reports and source selection govern which managed devices contribute data. In the present case, a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period; the more direct acceptance evidence is “The required time-period data is available in the report's query source and counts become nonzero” because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The proposed observation “A tested dataset produces threat rows and the corresponding chart renders in the next report run” would check a different original case: An analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. Its mechanism is: Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability. In the present case, a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period; the more direct acceptance evidence is “The required time-period data is available in the report's query source and counts become nonzero” because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

This safeguard, “Perform a section-inclusion preview for all deliverable report templates”, reduces a different source-defined risk: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. That risk depends on: Report layout and section selection determine which otherwise valid chart objects are included in output. The recurring problem here is a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The originally selected control “Set Analytics retention according to the report's maximum lookback requirement” is more specific because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

This safeguard, “Regression-test report grouping fields whenever parsers are updated”, reduces a different source-defined risk: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. That risk depends on: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. The recurring problem here is a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The originally selected control “Set Analytics retention according to the report's maximum lookback requirement” is more specific because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

This safeguard, “Audit device-group membership when renaming or replacing reporting sources”, reduces a different source-defined risk: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. That risk depends on: Report device filters select specific logging sources; similar names do not guarantee matching source membership. The recurring problem here is a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The originally selected control “Set Analytics retention according to the report's maximum lookback requirement” is more specific because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.