Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Benchmark report queries against maximum required lookback periods”, reduces a different source-defined risk: A custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. That risk depends on: Large historical scans can be expensive even when the query is logically valid and recent periods complete. The recurring problem here is a scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. The originally selected control “Monitor relay authentication failures and schedule secure credential rotation” is more specific because email transport authentication is independent of dataset correctness or report layout.

This safeguard, “Document time-zone and DST behavior for calendar-based scheduled reports”, reduces a different source-defined risk: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. That risk depends on: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. The recurring problem here is a scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. The originally selected control “Monitor relay authentication failures and schedule secure credential rotation” is more specific because email transport authentication is independent of dataset correctness or report layout.

This safeguard, “Require validation after custom SQL edits and retain rollback versions”, reduces a different source-defined risk: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. That risk depends on: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. The recurring problem here is a scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. The originally selected control “Monitor relay authentication failures and schedule secure credential rotation” is more specific because email transport authentication is independent of dataset correctness or report layout.

The action “Update the output profile's approved relay credentials and test outbound delivery separately from report generation” addresses a separate source case: A scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. Its underlying reason is: Email transport authentication is independent of dataset correctness or report layout. This question instead describes a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The original answer “Review hcache usage and disable unnecessary report auto-cache, using supported cleanup processes where appropriate” targets that failure because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The action “Verify operation mode and perform reporting from the associated Analyzer rather than troubleshooting browser cache” addresses a separate source case: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. Its underlying reason is: Collector mode does not provide the full Reports feature set offered in Analyzer mode. This question instead describes a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The original answer “Review hcache usage and disable unnecessary report auto-cache, using supported cleanup processes where appropriate” targets that failure because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The action “Inspect report layout dependencies and restore the referenced macro or remove the invalid element” addresses a separate source case: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. Its underlying reason is: A missing layout object can break one rendered component without affecting unrelated dataset queries. This question instead describes a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The original answer “Review hcache usage and disable unnecessary report auto-cache, using supported cleanup processes where appropriate” targets that failure because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The action “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” addresses a separate source case: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. Its underlying reason is: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. This question instead describes a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The original answer “Persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need” targets that failure because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The action “Local generation success does not prove external storage upload or retention succeeded” addresses a separate source case: An externally archived report cannot be retrieved though the generation task shows Completed and the local output file exists. Its underlying reason is: Local generation success does not prove external storage upload or retention succeeded. This question instead describes a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The original answer “Persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need” targets that failure because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The action “A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue” addresses a separate source case: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. Its underlying reason is: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. This question instead describes a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The original answer “Persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need” targets that failure because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The proposed observation “The completed report reaches the approved recipient after profile repair and the data remain unchanged” would check a different original case: A scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. Its mechanism is: Email transport authentication is independent of dataset correctness or report layout. In the present case, a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports; the more direct acceptance evidence is “Cache storage growth stops and active reports still generate with correct test values” because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The proposed observation “Old and new sample log formats map to the expected categories and total event count is conserved” would check a different original case: A threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. Its mechanism is: Changing normalized severity representation alters grouping even when the number of raw detections has not changed. In the present case, a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports; the more direct acceptance evidence is “Cache storage growth stops and active reports still generate with correct test values” because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The proposed observation “The same eligible logs are reportable on the central Analyzer, while Collector behavior matches documentation” would check a different original case: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. Its mechanism is: Collector mode does not provide the full Reports feature set offered in Analyzer mode. In the present case, a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports; the more direct acceptance evidence is “Cache storage growth stops and active reports still generate with correct test values” because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

This safeguard, “Specify and test maximum row counts for evidence-bearing reports”, reduces a different source-defined risk: An analyst exports a report that is truncated at an unexpectedly low row count, despite the underlying dataset containing many more records. That risk depends on: A presentation-level row limit can suppress displayed detail without removing records from the Analytics database. The recurring problem here is a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The originally selected control “Audit active cache dependencies and disk usage after removing old reports” is more specific because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

This safeguard, “Document time-zone and DST behavior for calendar-based scheduled reports”, reduces a different source-defined risk: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. That risk depends on: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. The recurring problem here is a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The originally selected control “Audit active cache dependencies and disk usage after removing old reports” is more specific because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

This safeguard, “Document feature availability by FortiAnalyzer operation mode”, reduces a different source-defined risk: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. That risk depends on: Collector mode does not provide the full Reports feature set offered in Analyzer mode. The recurring problem here is a monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. The originally selected control “Audit active cache dependencies and disk usage after removing old reports” is more specific because persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need.

The action “Open the dataset validator or task error, correct the faulty SQL expression, and retest the query” addresses a separate source case: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. Its underlying reason is: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. This question instead describes the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The original answer “Verify operation mode and perform reporting from the associated Analyzer rather than troubleshooting browser cache” targets that failure because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The action “Check report timezone and daylight-saving boundary semantics against UTC event times” addresses a separate source case: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. Its underlying reason is: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. This question instead describes the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The original answer “Verify operation mode and perform reporting from the associated Analyzer rather than troubleshooting browser cache” targets that failure because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The action “Move the report run after the supported ingestion/indexing completion window and verify delayed records” addresses a separate source case: A report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. Its underlying reason is: Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins. This question instead describes the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The original answer “Verify operation mode and perform reporting from the associated Analyzer rather than troubleshooting browser cache” targets that failure because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The action “Changing normalized severity representation alters grouping even when the number of raw detections has not changed” addresses a separate source case: A threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. Its underlying reason is: Changing normalized severity representation alters grouping even when the number of raw detections has not changed. This question instead describes the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The original answer “Collector mode does not provide the full Reports feature set offered in Analyzer mode” targets that failure because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The action “Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts” addresses a separate source case: A report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. Its underlying reason is: Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts. This question instead describes the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The original answer “Collector mode does not provide the full Reports feature set offered in Analyzer mode” targets that failure because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The action “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” addresses a separate source case: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. Its underlying reason is: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. This question instead describes the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The original answer “Collector mode does not provide the full Reports feature set offered in Analyzer mode” targets that failure because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The proposed observation “The chart displays Critical, High, Medium, and Low sample counts from the same underlying dataset” would check a different original case: A report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. Its mechanism is: Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings. In the present case, the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present; the more direct acceptance evidence is “The same eligible logs are reportable on the central Analyzer, while Collector behavior matches documentation” because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The proposed observation “Branch A and B outputs differ as expected on controlled disjoint source logs” would check a different original case: A report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. Its mechanism is: Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts. In the present case, the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present; the more direct acceptance evidence is “The same eligible logs are reportable on the central Analyzer, while Collector behavior matches documentation” because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The proposed observation “The rescheduled report includes the delayed batch and matches its reference log count” would check a different original case: A report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. Its mechanism is: Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins. In the present case, the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present; the more direct acceptance evidence is “The same eligible logs are reportable on the central Analyzer, while Collector behavior matches documentation” because collector mode does not provide the full Reports feature set offered in Analyzer mode.

This safeguard, “Specify and test maximum row counts for evidence-bearing reports”, reduces a different source-defined risk: An analyst exports a report that is truncated at an unexpectedly low row count, despite the underlying dataset containing many more records. That risk depends on: A presentation-level row limit can suppress displayed detail without removing records from the Analytics database. The recurring problem here is the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The originally selected control “Document feature availability by FortiAnalyzer operation mode” is more specific because collector mode does not provide the full Reports feature set offered in Analyzer mode.

This safeguard, “Bundle referenced datasets and charts during report imports”, reduces a different source-defined risk: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. That risk depends on: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. The recurring problem here is the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The originally selected control “Document feature availability by FortiAnalyzer operation mode” is more specific because collector mode does not provide the full Reports feature set offered in Analyzer mode.

This safeguard, “Document time-zone and DST behavior for calendar-based scheduled reports”, reduces a different source-defined risk: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. That risk depends on: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. The recurring problem here is the reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. The originally selected control “Document feature availability by FortiAnalyzer operation mode” is more specific because collector mode does not provide the full Reports feature set offered in Analyzer mode.

The action “Check report timezone and daylight-saving boundary semantics against UTC event times” addresses a separate source case: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. Its underlying reason is: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. This question instead describes a report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. The original answer “Restore the missing destination-ADOM dataset or relink the chart to an eligible local equivalent” targets that failure because report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere.

The action “Compare requested lookback to available Analytics partitions and revise retention or reporting expectations accordingly” addresses a separate source case: A report job fails when an ADOM's Analytics retention is shorter than the requested reporting period but the administrator searches only archive files. Its underlying reason is: Archive-only historical data may not be immediately queryable by Analytics-backed report datasets. This question instead describes a report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. The original answer “Restore the missing destination-ADOM dataset or relink the chart to an eligible local equivalent” targets that failure because report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere.

The action “Open the dataset validator or task error, correct the faulty SQL expression, and retest the query” addresses a separate source case: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. Its underlying reason is: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. This question instead describes a report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. The original answer “Restore the missing destination-ADOM dataset or relink the chart to an eligible local equivalent” targets that failure because report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere.

The action “Many-to-many joins multiply counts and can produce invalid ratios even when the underlying log records are correct” addresses a separate source case: A report calculates percentages above one hundred after joining event and endpoint inventories where endpoints have multiple asset records. Its underlying reason is: Many-to-many joins multiply counts and can produce invalid ratios even when the underlying log records are correct. This question instead describes a report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. The original answer “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” targets that failure because report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere.

The action “Local generation success does not prove external storage upload or retention succeeded” addresses a separate source case: An externally archived report cannot be retrieved though the generation task shows Completed and the local output file exists. Its underlying reason is: Local generation success does not prove external storage upload or retention succeeded. This question instead describes a report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. The original answer “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” targets that failure because report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere.

The action “Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins” addresses a separate source case: A report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. Its underlying reason is: Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins. This question instead describes a report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. The original answer “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” targets that failure because report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere.