Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Verify dataset source compatibility before promising multi-product analytics reports”, reduces a different source-defined risk: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. That risk depends on: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. The recurring problem here is an exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. The originally selected control “Perform a section-inclusion preview for all deliverable report templates” is more specific because report layout and section selection determine which otherwise valid chart objects are included in output.

This safeguard, “Test output-profile delivery after mail server or recipient changes”, reduces a different source-defined risk: The weekly report email is missing, but the report file exists in FortiAnalyzer's completed task history. That risk depends on: Report generation and outbound delivery are separate stages; a completed file can fail to reach recipients. The recurring problem here is an exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. The originally selected control “Perform a section-inclusion preview for all deliverable report templates” is more specific because report layout and section selection determine which otherwise valid chart objects are included in output.

This safeguard, “Test individual chart queries before publishing complex report templates”, reduces a different source-defined risk: An analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. That risk depends on: Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability. The recurring problem here is an exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. The originally selected control “Perform a section-inclusion preview for all deliverable report templates” is more specific because report layout and section selection determine which otherwise valid chart objects are included in output.

The action “Restore or relink a valid chart dataset and validate it before regenerating the report” addresses a separate source case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its underlying reason is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. This question instead describes a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The original answer “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” targets that failure because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The action “Confirm that eligible traffic logs reached the intended FortiAnalyzer Analytics database before changing report formatting” addresses a separate source case: A scheduled executive report is empty although the FortiGate still holds recent traffic locally, and analysts see no corresponding Analytics records in FortiAnalyzer. Its underlying reason is: Report datasets query locally available analytics logs; source-device local retention alone does not populate FortiAnalyzer reports. This question instead describes a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The original answer “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” targets that failure because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The action “Check Analytics retention and whether the relevant logs are available to the dataset instead of assuming an archive-only search populates charts” addresses a separate source case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its underlying reason is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. This question instead describes a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The original answer “Inspect report task errors and eligible output/temporary storage quotas, then restore headroom” targets that failure because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The action “FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source” addresses a separate source case: A custom report query returns a SQL validation error after an analyst adds a nonexistent log field from another product family. Its underlying reason is: FortiAnalyzer report SQL depends on actual supported dataset tables and fields for the log source. This question instead describes a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The original answer “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” targets that failure because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The action “Live or summarized views and scheduled report generation may consume data on different schedules” addresses a separate source case: A dashboard shows near-real-time detections, but a report run from the same ADOM is delayed and the analyst attributes the discrepancy to faulty detection rules. Its underlying reason is: Live or summarized views and scheduled report generation may consume data on different schedules. This question instead describes a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The original answer “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” targets that failure because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The action “A missing chart-to-dataset reference breaks visualization regardless of underlying log availability” addresses a separate source case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its underlying reason is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. This question instead describes a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The original answer “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” targets that failure because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The proposed observation “The required time-period data is available in the report's query source and counts become nonzero” would check a different original case: A threat chart reports zero detections, but raw IPS events are visible only in Archive and not in the Analytics store for the period. Its mechanism is: Report generation relies on analyzable data; retained archive files alone need not feed ordinary Analytics datasets. In the present case, a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title; the more direct acceptance evidence is “The task completes and the output file is stored without triggering storage alarms” because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The proposed observation “The chart resolves its dataset and renders correct sample values after the fix” would check a different original case: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. Its mechanism is: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. In the present case, a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title; the more direct acceptance evidence is “The task completes and the output file is stored without triggering storage alarms” because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The proposed observation “The original task completes after capacity or scheduling remediation without duplicate overlapping jobs” would check a different original case: A report job stays pending during a peak log-ingestion period, and an administrator repeatedly schedules duplicate jobs without checking system load. Its mechanism is: Long-running report queries compete for CPU, storage, and cache resources; repeated jobs can compound the backlog. In the present case, a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title; the more direct acceptance evidence is “The task completes and the output file is stored without triggering storage alarms” because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

This safeguard, “Perform a section-inclusion preview for all deliverable report templates”, reduces a different source-defined risk: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. That risk depends on: Report layout and section selection determine which otherwise valid chart objects are included in output. The recurring problem here is a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The originally selected control “Alert on free-space thresholds before high-volume scheduled report windows” is more specific because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

This safeguard, “Define metric semantics for counts, distinct entities, and sessions in report specifications”, reduces a different source-defined risk: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. That risk depends on: A count of events is not a count of unique principals unless the query groups or deduplicates identities. The recurring problem here is a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The originally selected control “Alert on free-space thresholds before high-volume scheduled report windows” is more specific because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

This safeguard, “Test individual chart queries before publishing complex report templates”, reduces a different source-defined risk: An analyst receives a report whose Top Threats chart is blank while another chart in the same report has data. That risk depends on: Each report chart can depend on a different query and log table, so one working chart does not establish another's data availability. The recurring problem here is a report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. The originally selected control “Alert on free-space thresholds before high-volume scheduled report windows” is more specific because report creation needs available working or destination storage; title edits cannot resolve capacity failures.

The action “Verify report scheduler timezone and source timestamps against the requested reporting boundary” addresses a separate source case: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. Its underlying reason is: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. This question instead describes an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The original answer “Verify the dataset log subtype matches the actual security records and align the report time window” targets that failure because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The action “Validate normalized fields and dataset grouping after the parser change before changing chart format” addresses a separate source case: A report's bar chart suddenly shows one unclassified category after a log parser update, while raw event counts stay consistent. Its underlying reason is: A grouping field that becomes null or changes meaning can collapse distinct rows into an unknown category. This question instead describes an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The original answer “Verify the dataset log subtype matches the actual security records and align the report time window” targets that failure because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The action “Check whether the dataset uses an appropriate distinct-user aggregation instead of raw row counts” addresses a separate source case: A chart labeled unique users counts every session as a separate user, inflating totals during a login burst. Its underlying reason is: A count of events is not a count of unique principals unless the query groups or deduplicates identities. This question instead describes an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The original answer “Verify the dataset log subtype matches the actual security records and align the report time window” targets that failure because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The action “Report device filters select specific logging sources; similar names do not guarantee matching source membership” addresses a separate source case: An incident report appears to omit a compromised IP because the source filter was set to a similarly named FortiGate group. Its underlying reason is: Report device filters select specific logging sources; similar names do not guarantee matching source membership. This question instead describes an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The original answer “Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype” targets that failure because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The action “Report creation needs available working or destination storage; title edits cannot resolve capacity failures” addresses a separate source case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its underlying reason is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. This question instead describes an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The original answer “Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype” targets that failure because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The action “Report layout and section selection determine which otherwise valid chart objects are included in output” addresses a separate source case: An exported report PDF is available but the requested chart is not visible because its containing section was disabled in the chosen template. Its underlying reason is: Report layout and section selection determine which otherwise valid chart objects are included in output. This question instead describes an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The original answer “Report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype” targets that failure because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The proposed observation “The late-night test event appears in the correct day's output after time alignment” would check a different original case: A daily report should contain the previous calendar day, but an execution at 00:05 uses the wrong timezone and excludes a late event. Its mechanism is: Report period boundaries and device clock interpretation can shift which events fall inside a daily report. In the present case, an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype; the more direct acceptance evidence is “The same sample IPS event appears in both its log view and the regenerated threat report” because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The proposed observation “The task completes and the output file is stored without triggering storage alarms” would check a different original case: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. Its mechanism is: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. In the present case, an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype; the more direct acceptance evidence is “The same sample IPS event appears in both its log view and the regenerated threat report” because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The proposed observation “A supported source scope and dataset return actual FortiMail records without inventing them” would check a different original case: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. Its mechanism is: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. In the present case, an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype; the more direct acceptance evidence is “The same sample IPS event appears in both its log view and the regenerated threat report” because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

This safeguard, “Alert on free-space thresholds before high-volume scheduled report windows”, reduces a different source-defined risk: A report generation task fails after the appliance reaches a storage threshold, but a user tries to fix only the scheduled report title. That risk depends on: Report creation needs available working or destination storage; title edits cannot resolve capacity failures. The recurring problem here is an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The originally selected control “Cross-check log type, timeframe, and device scope during blank-report triage” is more specific because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

This safeguard, “Use dependency inventories when deleting or renaming report datasets”, reduces a different source-defined risk: A custom report template references a deleted dataset, causing its chart to fail even though FortiAnalyzer shows no general log ingestion fault. That risk depends on: A missing chart-to-dataset reference breaks visualization regardless of underlying log availability. The recurring problem here is an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The originally selected control “Cross-check log type, timeframe, and device scope during blank-report triage” is more specific because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

This safeguard, “Verify dataset source compatibility before promising multi-product analytics reports”, reduces a different source-defined risk: An intrusion report includes no FortiMail rows although a FortiGate-only ADOM contains traffic data and the team expects a Fabric-wide query. That risk depends on: Dataset device-type support depends on the administrative domain; unrelated product logs are not automatically queryable. The recurring problem here is an analyst selects an hour-long incident window but the associated report includes no entries because its dataset filters to the wrong log subtype. The originally selected control “Cross-check log type, timeframe, and device scope during blank-report triage” is more specific because report rows are drawn from the chosen log category; a valid timeframe alone cannot compensate for the wrong subtype.

The action “Configure a correlation event handler with ordered conditions and the required source grouping and time window” addresses a separate source case: A detection should fire only if several failed administrator logins are followed by one success from the same source within a defined period, not on any single failure. Its underlying reason is: Correlation handlers combine rules with operators such as FOLLOWED_BY and can represent a sequence of related activity. This question instead describes a SOC must alert when either a FortiGate malware detection OR a web-filter block occurs, but an analyst creates two manual incident tickets for every matching record. The original answer “Configure an appropriate basic event handler with separate malware and web-filter rules and scoped notification handling” targets that failure because rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches.

The action “Change the data selector to the supported FortiMail source and matching log type in the correct ADOM” addresses a separate source case: An event handler works in the lab but misses production FortiMail activity after copying its selector from a FortiGate-only policy. Its underlying reason is: An event handler only evaluates records within its device, log-type, and filter selection. This question instead describes a SOC must alert when either a FortiGate malware detection OR a web-filter block occurs, but an analyst creates two manual incident tickets for every matching record. The original answer “Configure an appropriate basic event handler with separate malware and web-filter rules and scoped notification handling” targets that failure because rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches.

The action “Associate a valid notification profile and verify the chosen notification destination and delivery path” addresses a separate source case: A high-severity handler creates events but no email arrives, and engineers change its detection threshold despite positive match evidence. Its underlying reason is: Event-handler rule matching generates an event; its notification profile independently determines where alerts are sent. This question instead describes a SOC must alert when either a FortiGate malware detection OR a web-filter block occurs, but an analyst creates two manual incident tickets for every matching record. The original answer “Configure an appropriate basic event handler with separate malware and web-filter rules and scoped notification handling” targets that failure because rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches.

The action “Grouping matching records by a stable attack identifier can reduce event multiplicity without discarding the associated logs” addresses a separate source case: A SOC alarm fires hundreds of times for the same scanning IP, and the investigation needs one grouped event per attacker rather than one for each destination port. Its underlying reason is: Grouping matching records by a stable attack identifier can reduce event multiplicity without discarding the associated logs. This question instead describes a SOC must alert when either a FortiGate malware detection OR a web-filter block occurs, but an analyst creates two manual incident tickets for every matching record. The original answer “Rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches” targets that failure because rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches.

The action “Some predefined handlers are disabled until activated; matching source logs are insufficient while the handler or its scope is inactive” addresses a separate source case: A predefined intrusion event handler is present in the catalog but does not produce events after fresh matching FortiGate attack logs arrive. Its underlying reason is: Some predefined handlers are disabled until activated; matching source logs are insufficient while the handler or its scope is inactive. This question instead describes a SOC must alert when either a FortiGate malware detection OR a web-filter block occurs, but an analyst creates two manual incident tickets for every matching record. The original answer “Rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches” targets that failure because rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches.

The action “A negative temporal relationship can detect the absence of a required follow-up event after a preceding event” addresses a separate source case: A SOC wants an alert if a failed backup occurs and no recovery confirmation arrives within the allowed interval. Its underlying reason is: A negative temporal relationship can detect the absence of a required follow-up event after a preceding event. This question instead describes a SOC must alert when either a FortiGate malware detection OR a web-filter block occurs, but an analyst creates two manual incident tickets for every matching record. The original answer “Rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches” targets that failure because rules within a basic event handler are combined with OR semantics so an event can arise when an individual configured rule matches.