Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Perform a section-inclusion preview for all deliverable report templates”, reduces a different source-defined risk: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. That risk depends on: Report layout and section selection determine which otherwise valid chart objects are included in output. The recurring problem here is a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The originally selected control “Set Analytics retention according to the report's maximum lookback requirement” is more specific because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

This safeguard, “Regression-test report grouping fields whenever parsers are updated”, reduces a different source-defined risk: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. That risk depends on: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. The recurring problem here is a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The originally selected control “Set Analytics retention according to the report's maximum lookback requirement” is more specific because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

This safeguard, “Audit device-group membership when renaming or replacing reporting sources”, reduces a different source-defined risk: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. That risk depends on: Report device filters select specific logging sources; similar names do not guarantee matching source membership. The recurring problem here is a threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. The originally selected control “Set Analytics retention according to the report's maximum lookback requirement” is more specific because report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets.

The action “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The original answer “Verify report scheduler timezone and source timestamps against the requested reporting boundary” targets that failure because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The action “Compare the report's SQL processing window, task completion, and Analytics indexing timing with the live display” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The original answer “Verify report scheduler timezone and source timestamps against the requested reporting boundary” targets that failure because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The action “Assess whether the ADOM and dataset support the FortiMail log type or require an appropriate Fabric ADOM” addresses a separate source case: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. Its underlying reason is: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. This question instead describes a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The original answer “Verify report scheduler timezone and source timestamps against the requested reporting boundary” targets that failure because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The action “ADOM-specific reports and source selection govern which managed devices contribute data” addresses a separate source case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its underlying reason is: ADOM-specific reports and source selection govern which managed devices contribute data. This question instead describes a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The original answer “Report period boundaries and device clock interpretation can shift which events fall inside a daily report” targets that failure because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The action “Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype” addresses a separate source case: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. Its underlying reason is: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. This question instead describes a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The original answer “Report period boundaries and device clock interpretation can shift which events fall inside a daily report” targets that failure because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The action “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The original answer “Report period boundaries and device clock interpretation can shift which events fall inside a daily report” targets that failure because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The proposed observation “Two sessions by one test user count as one unique user in the corrected report” would check a different original case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its mechanism is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. In the present case, a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event; the more direct acceptance evidence is “The late-night test event appears in the correct day's output after time alignment” because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The proposed observation “The corrected query validates and returns representative rows before a full report run” would check a different original case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its mechanism is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. In the present case, a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event; the more direct acceptance evidence is “The late-night test event appears in the correct day's output after time alignment” because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The proposed observation “The required time-period data is available in the report's query source and counts become nonzero” would check a different original case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its mechanism is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. In the present case, a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event; the more direct acceptance evidence is “The late-night test event appears in the correct day's output after time alignment” because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

This safeguard, “Test output-profile delivery after mail server or recipient changes”, reduces a different source-defined risk: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. That risk depends on: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. The recurring problem here is a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The originally selected control “Standardize reporting timezone conventions across distributed SOC teams” is more specific because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

This safeguard, “Alert on free-space thresholds before high-volume scheduled report windows”, reduces a different source-defined risk: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. That risk depends on: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. The recurring problem here is a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The originally selected control “Standardize reporting timezone conventions across distributed SOC teams” is more specific because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

This safeguard, “Check source ingestion and Analytics availability before diagnosing blank reports”, reduces a different source-defined risk: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. That risk depends on: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. The recurring problem here is a daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. The originally selected control “Standardize reporting timezone conventions across distributed SOC teams” is more specific because report period boundaries and device clock interpretation can shift which events fall inside a daily report.

The action “Run dataset Validate or Analyze Query and correct the table and field references to the selected log type” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The original answer “Restore or relink a valid chart dataset and validate it before regenerating the report” targets that failure because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The action “Confirm that eligible traffic logs reached the intended FortiAnalyzer Analytics database before changing report formatting” addresses a separate source case: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. Its underlying reason is: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. This question instead describes a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The original answer “Restore or relink a valid chart dataset and validate it before regenerating the report” targets that failure because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The action “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” addresses a separate source case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its underlying reason is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. This question instead describes a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The original answer “Restore or relink a valid chart dataset and validate it before regenerating the report” targets that failure because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The action “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The original answer “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” targets that failure because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The original answer “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” targets that failure because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The action “A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The original answer “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” targets that failure because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The proposed observation “The next export visibly contains the intended chart with unchanged dataset rows” would check a different original case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its mechanism is: Report layout and section selection determine which otherwise valid chart objects are included in output. In the present case, a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault; the more direct acceptance evidence is “The chart resolves its dataset and renders correct sample values after the fix” because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The proposed observation “The intended FortiGate serial contributes its test record after filter correction” would check a different original case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its mechanism is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. In the present case, a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault; the more direct acceptance evidence is “The chart resolves its dataset and renders correct sample values after the fix” because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The proposed observation “The required time-period data is available in the report's query source and counts become nonzero” would check a different original case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its mechanism is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. In the present case, a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault; the more direct acceptance evidence is “The chart resolves its dataset and renders correct sample values after the fix” because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

This safeguard, “Cross-check log type, timeframe, and device scope during blank-report triage”, reduces a different source-defined risk: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. That risk depends on: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. The recurring problem here is a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The originally selected control “Use dependency inventories when deleting or renaming report datasets” is more specific because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

This safeguard, “Require explicit report-period confirmation in analyst review checklists”, reduces a different source-defined risk: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. That risk depends on: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. The recurring problem here is a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The originally selected control “Use dependency inventories when deleting or renaming report datasets” is more specific because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

This safeguard, “Use a log-field reference and query validation for dataset changes”, reduces a different source-defined risk: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. That risk depends on: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. The recurring problem here is a custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. The originally selected control “Use dependency inventories when deleting or renaming report datasets” is more specific because a missing chart-to-dataset reference breaks visualization regardless of underlying log availability.

The action “Confirm that eligible traffic logs reached the intended FortiAnalyzer Analytics database before changing report formatting” addresses a separate source case: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. Its underlying reason is: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Inspect FortiAnalyzer report task status and resource utilization before retrying or rescheduling the report” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “Validate normalized fields and dataset grouping after the parser change before changing chart format” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Inspect FortiAnalyzer report task status and resource utilization before retrying or rescheduling the report” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Inspect FortiAnalyzer report task status and resource utilization before retrying or rescheduling the report” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets” addresses a separate source case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its underlying reason is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” addresses a separate source case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its underlying reason is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.