Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Regression-test report grouping fields whenever parsers are updated”, reduces a different source-defined risk: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. That risk depends on: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. The recurring problem here is a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The originally selected control “Define metric semantics for counts, distinct entities, and sessions in report specifications” is more specific because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

This safeguard, “Test output-profile delivery after mail server or recipient changes”, reduces a different source-defined risk: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. That risk depends on: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. The recurring problem here is a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The originally selected control “Define metric semantics for counts, distinct entities, and sessions in report specifications” is more specific because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

This safeguard, “Audit device-group membership when renaming or replacing reporting sources”, reduces a different source-defined risk: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. That risk depends on: Report device filters select specific logging sources; similar names do not guarantee matching source membership. The recurring problem here is a chart labeled unique users counts every session as a separate user, inflating totals during a login burst. The originally selected control “Define metric semantics for counts, distinct entities, and sessions in report specifications” is more specific because a count of events is not a count of unique principals unless the query groups or deduplicates identities.

The action “Assess whether the ADOM and dataset support the FortiMail log type or require an appropriate Fabric ADOM” addresses a separate source case: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. Its underlying reason is: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. This question instead describes a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The original answer “Run dataset Validate or Analyze Query and correct the table and field references to the selected log type” targets that failure because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The action “Restore or relink a valid chart dataset and validate it before regenerating the report” addresses a separate source case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its underlying reason is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. This question instead describes a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The original answer “Run dataset Validate or Analyze Query and correct the table and field references to the selected log type” targets that failure because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The action “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The original answer “Run dataset Validate or Analyze Query and correct the table and field references to the selected log type” targets that failure because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The original answer “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” targets that failure because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The action “Report period boundaries and device clock interpretation can shift which events fall inside a daily report” addresses a separate source case: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. Its underlying reason is: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. This question instead describes a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The original answer “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” targets that failure because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The action “Report layout and section selection determine which otherwise valid chart objects are included in output” addresses a separate source case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its underlying reason is: Report layout and section selection determine which otherwise valid chart objects are included in output. This question instead describes a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The original answer “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” targets that failure because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The proposed observation “Two sessions by one test user count as one unique user in the corrected report” would check a different original case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its mechanism is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. In the present case, a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family; the more direct acceptance evidence is “The corrected query validates and returns representative rows before a full report run” because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The proposed observation “A supported source scope and dataset return actual FortiMail records without inventing them” would check a different original case: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. Its mechanism is: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. In the present case, a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family; the more direct acceptance evidence is “The corrected query validates and returns representative rows before a full report run” because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The proposed observation “The task completes and the output file is stored without triggering storage alarms” would check a different original case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its mechanism is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. In the present case, a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family; the more direct acceptance evidence is “The corrected query validates and returns representative rows before a full report run” because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

This safeguard, “Cross-check log type, timeframe, and device scope during blank-report triage”, reduces a different source-defined risk: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. That risk depends on: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. The recurring problem here is a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The originally selected control “Use a log-field reference and query validation for dataset changes” is more specific because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

This safeguard, “Recheck ADOM and device filters when reusing report templates”, reduces a different source-defined risk: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. That risk depends on: ADOM-specific reports and source selection govern which managed devices contribute data. The recurring problem here is a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The originally selected control “Use a log-field reference and query validation for dataset changes” is more specific because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

This safeguard, “Regression-test report grouping fields whenever parsers are updated”, reduces a different source-defined risk: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. That risk depends on: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. The recurring problem here is a custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. The originally selected control “Use a log-field reference and query validation for dataset changes” is more specific because FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source.

The action “Compare the report's SQL processing window, task completion, and Analytics indexing timing with the live display” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The original answer “Verify actual device IDs and report filter membership rather than only the human-readable group label” targets that failure because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The action “Verify the dataset log subtype matches the actual security records and align the report time window” addresses a separate source case: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. Its underlying reason is: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. This question instead describes an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The original answer “Verify actual device IDs and report filter membership rather than only the human-readable group label” targets that failure because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The action “Validate the failing chart's dataset and its selected security log type separately from the healthy charts” addresses a separate source case: An analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. Its underlying reason is: Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability. This question instead describes an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The original answer “Verify actual device IDs and report filter membership rather than only the human-readable group label” targets that failure because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The action “Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets” addresses a separate source case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its underlying reason is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. This question instead describes an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The original answer “Report device filters select specific logging sources; similar names do not guarantee matching source membership” targets that failure because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The action “Report period boundaries and device clock interpretation can shift which events fall inside a daily report” addresses a separate source case: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. Its underlying reason is: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. This question instead describes an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The original answer “Report device filters select specific logging sources; similar names do not guarantee matching source membership” targets that failure because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The action “A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The original answer “Report device filters select specific logging sources; similar names do not guarantee matching source membership” targets that failure because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The proposed observation “Sample normalized records restore expected group labels and the chart categories reappear” would check a different original case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its mechanism is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. In the present case, an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group; the more direct acceptance evidence is “The intended FortiGate serial contributes its test record after filter correction” because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The proposed observation “The chart resolves its dataset and renders correct sample values after the fix” would check a different original case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its mechanism is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. In the present case, an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group; the more direct acceptance evidence is “The intended FortiGate serial contributes its test record after filter correction” because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The proposed observation “A rerun restricted to yesterday contains only relevant event timestamps” would check a different original case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its mechanism is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. In the present case, an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group; the more direct acceptance evidence is “The intended FortiGate serial contributes its test record after filter correction” because report device filters select specific logging sources; similar names do not guarantee matching source membership.

This safeguard, “Test output-profile delivery after mail server or recipient changes”, reduces a different source-defined risk: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. That risk depends on: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. The recurring problem here is an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The originally selected control “Audit device-group membership when renaming or replacing reporting sources” is more specific because report device filters select specific logging sources; similar names do not guarantee matching source membership.

This safeguard, “Check source ingestion and Analytics availability before diagnosing blank reports”, reduces a different source-defined risk: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. That risk depends on: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. The recurring problem here is an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The originally selected control “Audit device-group membership when renaming or replacing reporting sources” is more specific because report device filters select specific logging sources; similar names do not guarantee matching source membership.

This safeguard, “Cross-check log type, timeframe, and device scope during blank-report triage”, reduces a different source-defined risk: An analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. That risk depends on: Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype. The recurring problem here is an incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. The originally selected control “Audit device-group membership when renaming or replacing reporting sources” is more specific because report device filters select specific logging sources; similar names do not guarantee matching source membership.

The action “Run dataset Validate or Analyze Query and correct the table and field references to the selected log type” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes a dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. The original answer “Compare the report's SQL processing window, task completion, and Analytics indexing timing with the live display” targets that failure because live or summarized views and scheduled report generation may consume data on different schedules.

The action “Verify the report's current ADOM and permitted device selection before interpreting its metrics” addresses a separate source case: A report shows devices from the wrong tenant after an administrator copied an existing template across ADOMs. Its underlying reason is: ADOM-specific reports and source selection govern which managed devices contribute data. This question instead describes a dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. The original answer “Compare the report's SQL processing window, task completion, and Analytics indexing timing with the live display” targets that failure because live or summarized views and scheduled report generation may consume data on different schedules.

The action “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” addresses a separate source case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its underlying reason is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. This question instead describes a dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. The original answer “Compare the report's SQL processing window, task completion, and Analytics indexing timing with the live display” targets that failure because live or summarized views and scheduled report generation may consume data on different schedules.

The action “Report layout and section selection determine which otherwise valid chart objects are included in output” addresses a separate source case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its underlying reason is: Report layout and section selection determine which otherwise valid chart objects are included in output. This question instead describes a dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. The original answer “Live or summarized views and scheduled report generation may consume data on different schedules” targets that failure because live or summarized views and scheduled report generation may consume data on different schedules.

The action “Report query time scope determines which historical logs enter dataset results, independent of visual chart selection” addresses a separate source case: A report for yesterday produces rows from last month, and the operator assumes the chart type is malfunctioning. Its underlying reason is: Report query time scope determines which historical logs enter dataset results, independent of visual chart selection. This question instead describes a dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. The original answer “Live or summarized views and scheduled report generation may consume data on different schedules” targets that failure because live or summarized views and scheduled report generation may consume data on different schedules.

The action “Report device filters select specific logging sources; similar names do not guarantee matching source membership” addresses a separate source case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its underlying reason is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. This question instead describes a dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. The original answer “Live or summarized views and scheduled report generation may consume data on different schedules” targets that failure because live or summarized views and scheduled report generation may consume data on different schedules.