Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The action “Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets” addresses a separate source case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its underlying reason is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” addresses a separate source case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its underlying reason is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. This question instead describes a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The original answer “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” targets that failure because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The proposed observation “The completed report is delivered to the approved test mailbox while its content remains unchanged” would check a different original case: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. Its mechanism is: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. In the present case, a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load; the more direct acceptance evidence is “The original task completes after capacity or scheduling remediation without duplicate overlapping jobs” because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The proposed observation “The late-night test event appears in the correct day's output after time alignment” would check a different original case: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. Its mechanism is: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. In the present case, a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load; the more direct acceptance evidence is “The original task completes after capacity or scheduling remediation without duplicate overlapping jobs” because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The proposed observation “The corrected query validates and returns representative rows before a full report run” would check a different original case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its mechanism is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. In the present case, a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load; the more direct acceptance evidence is “The original task completes after capacity or scheduling remediation without duplicate overlapping jobs” because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

This safeguard, “Require explicit report-period confirmation in analyst review checklists”, reduces a different source-defined risk: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. That risk depends on: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. The recurring problem here is a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The originally selected control “Plan report concurrency and monitor queue depth for heavy reporting windows” is more specific because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

This safeguard, “Set Analytics retention according to the report's maximum lookback requirement”, reduces a different source-defined risk: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. That risk depends on: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. The recurring problem here is a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The originally selected control “Plan report concurrency and monitor queue depth for heavy reporting windows” is more specific because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

This safeguard, “Use a log-field reference and query validation for dataset changes”, reduces a different source-defined risk: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. That risk depends on: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. The recurring problem here is a report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. The originally selected control “Plan report concurrency and monitor queue depth for heavy reporting windows” is more specific because long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog.

The action “Validate normalized fields and dataset grouping after the parser change before changing chart format” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The original answer “Investigate the output profile's mail destination and delivery configuration rather than regenerating the report contents” targets that failure because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The action “Verify the dataset log subtype matches the actual security records and align the report time window” addresses a separate source case: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. Its underlying reason is: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. This question instead describes the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The original answer “Investigate the output profile's mail destination and delivery configuration rather than regenerating the report contents” targets that failure because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The action “Inspect report time period and scheduled run parameters against the business-requested interval” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The original answer “Investigate the output profile's mail destination and delivery configuration rather than regenerating the report contents” targets that failure because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The original answer “Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients” targets that failure because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The action “Report device filters select specific logging sources; similar names do not guarantee matching source membership” addresses a separate source case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its underlying reason is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. This question instead describes the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The original answer “Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients” targets that failure because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The action “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” addresses a separate source case: A report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. Its underlying reason is: Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog. This question instead describes the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The original answer “Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients” targets that failure because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The proposed observation “Sample normalized records restore expected group labels and the chart categories reappear” would check a different original case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its mechanism is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. In the present case, the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history; the more direct acceptance evidence is “The completed report is delivered to the approved test mailbox while its content remains unchanged” because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The proposed observation “A rerun restricted to yesterday contains only relevant event timestamps” would check a different original case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its mechanism is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. In the present case, the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history; the more direct acceptance evidence is “The completed report is delivered to the approved test mailbox while its content remains unchanged” because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The proposed observation “The task completes and the output file is stored without triggering storage alarms” would check a different original case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its mechanism is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. In the present case, the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history; the more direct acceptance evidence is “The completed report is delivered to the approved test mailbox while its content remains unchanged” because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

This safeguard, “Use dependency inventories when deleting or renaming report datasets”, reduces a different source-defined risk: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. That risk depends on: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. The recurring problem here is the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The originally selected control “Test output-profile delivery after mail server or recipient changes” is more specific because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

This safeguard, “Standardize reporting timezone conventions across distributed SOC teams”, reduces a different source-defined risk: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. That risk depends on: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. The recurring problem here is the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The originally selected control “Test output-profile delivery after mail server or recipient changes” is more specific because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

This safeguard, “Alert on free-space thresholds before high-volume scheduled report windows”, reduces a different source-defined risk: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. That risk depends on: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. The recurring problem here is the weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. The originally selected control “Test output-profile delivery after mail server or recipient changes” is more specific because report generation and outbound delivery are separate stages; a completed file can fail to reach recipients.

The action “Verify the report's current ADOM and permitted device selection before interpreting its metrics” addresses a separate source case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its underlying reason is: ADOM-specific reports and source selection govern which managed devices contribute data. This question instead describes a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The original answer “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” targets that failure because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The action “Validate normalized fields and dataset grouping after the parser change before changing chart format” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The original answer “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” targets that failure because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The action “Assess whether the ADOM and dataset support the FortiMail log type or require an appropriate Fabric ADOM” addresses a separate source case: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. Its underlying reason is: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. This question instead describes a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The original answer “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” targets that failure because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The action “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The original answer “A count of events is not a count of unique principals unless the query groups or deduplicates identities” targets that failure because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The action “Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog” addresses a separate source case: A report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. Its underlying reason is: Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog. This question instead describes a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The original answer “A count of events is not a count of unique principals unless the query groups or deduplicates identities” targets that failure because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The action “A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The original answer “A count of events is not a count of unique principals unless the query groups or deduplicates identities” targets that failure because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The proposed observation “A rerun restricted to yesterday contains only relevant event timestamps” would check a different original case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its mechanism is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. In the present case, a chart labeled unique users counts every session as a separate user, inflating totals during a login burst; the more direct acceptance evidence is “Two sessions by one test user count as one unique user in the corrected report” because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The proposed observation “The next export visibly contains the intended chart with unchanged dataset rows” would check a different original case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its mechanism is: Report layout and section selection determine which otherwise valid chart objects are included in output. In the present case, a chart labeled unique users counts every session as a separate user, inflating totals during a login burst; the more direct acceptance evidence is “Two sessions by one test user count as one unique user in the corrected report” because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The proposed observation “The task completes and the output file is stored without triggering storage alarms” would check a different original case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its mechanism is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. In the present case, a chart labeled unique users counts every session as a separate user, inflating totals during a login burst; the more direct acceptance evidence is “Two sessions by one test user count as one unique user in the corrected report” because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

This safeguard, “Regression-test report grouping fields whenever parsers are updated”, reduces a different source-defined risk: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. That risk depends on: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. The recurring problem here is a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The originally selected control “Define metric semantics for counts, distinct entities, and sessions in report specifications” is more specific because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

This safeguard, “Test output-profile delivery after mail server or recipient changes”, reduces a different source-defined risk: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. That risk depends on: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. The recurring problem here is a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The originally selected control “Define metric semantics for counts, distinct entities, and sessions in report specifications” is more specific because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

This safeguard, “Audit device-group membership when renaming or replacing reporting sources”, reduces a different source-defined risk: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. That risk depends on: Report device filters select specific logging sources; similar names do not guarantee matching source membership. The recurring problem here is a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The originally selected control “Define metric semantics for counts, distinct entities, and sessions in report specifications” is more specific because a count of events is not a count of unique principals unless the query groups or deduplicates identities.