Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The action “Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings” addresses a separate source case: A report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. Its underlying reason is: Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings. This question instead describes a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. The original answer “Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins” targets that failure because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

The action “Collector mode does not provide the full Reports feature set offered in Analyzer mode” addresses a separate source case: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. Its underlying reason is: Collector mode does not provide the full Reports feature set offered in Analyzer mode. This question instead describes a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. The original answer “Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins” targets that failure because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

The action “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” addresses a separate source case: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. Its underlying reason is: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. This question instead describes a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. The original answer “Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins” targets that failure because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

The proposed observation “An optimized or cached year-long test returns correct totals within the approved runtime” would check a different original case: A custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. Its mechanism is: Large historical scans can be expensive even when the query is logically valid and recent periods complete. In the present case, a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch; the more direct acceptance evidence is “The rescheduled report includes the delayed batch and matches its reference log count” because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

The proposed observation “The corrected period returns actual available rows and unavailable history is identified explicitly” would check a different original case: A report job fails when an ADOM's Analytics retention is shorter than the requested reporting period but the administrator searches only archive files. Its mechanism is: Archive-only historical data may not be immediately queryable by Analytics-backed report datasets. In the present case, a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch; the more direct acceptance evidence is “The rescheduled report includes the delayed batch and matches its reference log count” because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

The proposed observation “The destination report resolves its chart dependencies and runs a sample query successfully” would check a different original case: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. Its mechanism is: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. In the present case, a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch; the more direct acceptance evidence is “The rescheduled report includes the delayed batch and matches its reference log count” because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

This safeguard, “Align report schedules and retention settings with business reporting windows”, reduces a different source-defined risk: A report job fails when an ADOM's Analytics retention is shorter than the requested reporting period but the administrator searches only archive files. That risk depends on: Archive-only historical data may not be immediately queryable by Analytics-backed report datasets. The recurring problem here is a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. The originally selected control “Monitor ingestion completion as a dependency for scheduled reporting” is more specific because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

This safeguard, “Monitor remote delivery acknowledgments and archive availability independently”, reduces a different source-defined risk: An externally archived report cannot be retrieved though the generation task shows Completed and the local output file exists. That risk depends on: Local generation success does not prove external storage upload or retention succeeded. The recurring problem here is a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. The originally selected control “Monitor ingestion completion as a dependency for scheduled reporting” is more specific because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

This safeguard, “Document time-zone and DST behavior for calendar-based scheduled reports”, reduces a different source-defined risk: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. That risk depends on: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. The recurring problem here is a report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. The originally selected control “Monitor ingestion completion as a dependency for scheduled reporting” is more specific because report output can be incomplete if its source Analytics records have not yet become queryable when execution begins.

The action “Open the dataset validator or task error, correct the faulty SQL expression, and retest the query” addresses a separate source case: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. Its underlying reason is: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. This question instead describes a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The original answer “Identify both scheduling definitions, retain the intended owner schedule, and disable the redundant one” targets that failure because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The action “Inspect actual log fields and adjust the dataset's null-safe user expression rather than inventing identities” addresses a separate source case: A report chart shows null values for source usernames after a FortiGate firmware update changed an optional field's availability. Its underlying reason is: Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined. This question instead describes a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The original answer “Identify both scheduling definitions, retain the intended owner schedule, and disable the redundant one” targets that failure because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The action “Move the report run after the supported ingestion/indexing completion window and verify delayed records” addresses a separate source case: A report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. Its underlying reason is: Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins. This question instead describes a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The original answer “Identify both scheduling definitions, retain the intended owner schedule, and disable the redundant one” targets that failure because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The action “Collector mode does not provide the full Reports feature set offered in Analyzer mode” addresses a separate source case: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. Its underlying reason is: Collector mode does not provide the full Reports feature set offered in Analyzer mode. This question instead describes a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The original answer “Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry” targets that failure because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The action “Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined” addresses a separate source case: A report chart shows null values for source usernames after a FortiGate firmware update changed an optional field's availability. Its underlying reason is: Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined. This question instead describes a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The original answer “Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry” targets that failure because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The action “Local generation success does not prove external storage upload or retention succeeded” addresses a separate source case: An externally archived report cannot be retrieved though the generation task shows Completed and the local output file exists. Its underlying reason is: Local generation success does not prove external storage upload or retention succeeded. This question instead describes a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The original answer “Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry” targets that failure because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The proposed observation “The rescheduled report includes the delayed batch and matches its reference log count” would check a different original case: A report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. Its mechanism is: Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins. In the present case, a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs; the more direct acceptance evidence is “The next cycle produces one intended notification with the correct ADOM-scoped report” because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The proposed observation “A controlled report displays the required number of entries after adjusting its output limit” would check a different original case: An analyst exports a report that is truncated at an unexpectedly low row count, despite the underlying dataset containing many more records. Its mechanism is: A presentation-level row limit can suppress displayed detail without removing records from the Analytics database. In the present case, a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs; the more direct acceptance evidence is “The next cycle produces one intended notification with the correct ADOM-scoped report” because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The proposed observation “The restored macro displays a valid test value in a new export” would check a different original case: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. Its mechanism is: A missing layout object can break one rendered component without affecting unrelated dataset queries. In the present case, a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs; the more direct acceptance evidence is “The next cycle produces one intended notification with the correct ADOM-scoped report” because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

This safeguard, “Validate all report layout references after removing charts, macros, or templates”, reduces a different source-defined risk: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. That risk depends on: A missing layout object can break one rendered component without affecting unrelated dataset queries. The recurring problem here is a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The originally selected control “Audit active schedules and recipients after migrations and imports” is more specific because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

This safeguard, “Document time-zone and DST behavior for calendar-based scheduled reports”, reduces a different source-defined risk: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. That risk depends on: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. The recurring problem here is a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The originally selected control “Audit active schedules and recipients after migrations and imports” is more specific because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

This safeguard, “Require validation after custom SQL edits and retain rollback versions”, reduces a different source-defined risk: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. That risk depends on: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. The recurring problem here is a scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. The originally selected control “Audit active schedules and recipients after migrations and imports” is more specific because separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry.

The action “Inspect actual log fields and adjust the dataset's null-safe user expression rather than inventing identities” addresses a separate source case: A report chart shows null values for source usernames after a FortiGate firmware update changed an optional field's availability. Its underlying reason is: Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined. This question instead describes a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The original answer “Inspect chart properties and remove or correct the stale severity filter while retaining the dataset” targets that failure because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The action “Move the report run after the supported ingestion/indexing completion window and verify delayed records” addresses a separate source case: A report task produces an empty file because the schedule starts before new Analytics log partitions finish processing after a nightly collection batch. Its underlying reason is: Report output can be incomplete if its source Analytics records have not yet become queryable when execution begins. This question instead describes a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The original answer “Inspect chart properties and remove or correct the stale severity filter while retaining the dataset” targets that failure because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The action “Restore the missing destination-ADOM dataset or relink the chart to an eligible local equivalent” addresses a separate source case: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. Its underlying reason is: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. This question instead describes a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The original answer “Inspect chart properties and remove or correct the stale severity filter while retaining the dataset” targets that failure because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The action “Large historical scans can be expensive even when the query is logically valid and recent periods complete” addresses a separate source case: A custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. Its underlying reason is: Large historical scans can be expensive even when the query is logically valid and recent periods complete. This question instead describes a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The original answer “Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings” targets that failure because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The action “Email transport authentication is independent of dataset correctness or report layout” addresses a separate source case: A scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. Its underlying reason is: Email transport authentication is independent of dataset correctness or report layout. This question instead describes a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The original answer “Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings” targets that failure because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The action “Changing normalized severity representation alters grouping even when the number of raw detections has not changed” addresses a separate source case: A threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. Its underlying reason is: Changing normalized severity representation alters grouping even when the number of raw detections has not changed. This question instead describes a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The original answer “Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings” targets that failure because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The proposed observation “The restored macro displays a valid test value in a new export” would check a different original case: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. Its mechanism is: A missing layout object can break one rendered component without affecting unrelated dataset queries. In the present case, a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical; the more direct acceptance evidence is “The chart displays Critical, High, Medium, and Low sample counts from the same underlying dataset” because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The proposed observation “The corrected period returns actual available rows and unavailable history is identified explicitly” would check a different original case: A report job fails when an ADOM's Analytics retention is shorter than the requested reporting period but the administrator searches only archive files. Its mechanism is: Archive-only historical data may not be immediately queryable by Analytics-backed report datasets. In the present case, a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical; the more direct acceptance evidence is “The chart displays Critical, High, Medium, and Low sample counts from the same underlying dataset” because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

The proposed observation “Cache storage growth stops and active reports still generate with correct test values” would check a different original case: A monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. Its mechanism is: Persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need. In the present case, a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical; the more direct acceptance evidence is “The chart displays Critical, High, Medium, and Low sample counts from the same underlying dataset” because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

This safeguard, “Audit active schedules and recipients after migrations and imports”, reduces a different source-defined risk: A scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. That risk depends on: Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry. The recurring problem here is a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The originally selected control “Review chart-specific filters during report layout revisions” is more specific because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

This safeguard, “Include multi-device negative tests when validating report filter bindings”, reduces a different source-defined risk: A report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. That risk depends on: Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts. The recurring problem here is a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The originally selected control “Review chart-specific filters during report layout revisions” is more specific because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.

This safeguard, “Bundle referenced datasets and charts during report imports”, reduces a different source-defined risk: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. That risk depends on: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. The recurring problem here is a report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. The originally selected control “Review chart-specific filters during report layout revisions” is more specific because chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings.