This configures a different design mechanism (Playbook task dependency ordering). FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. That mechanism does not satisfy this particular requirement: A SOC auditor requests evidence that a notification and ticket action ran for a critical case.

This configures a different design mechanism (Predefined event handler enablement). FortiAnalyzer supplies predefined handlers for supported products but not every handler is active by default. That mechanism does not satisfy this particular requirement: A SOC auditor requests evidence that a notification and ticket action ran for a critical case.

This configures a different design mechanism (On-demand playbook triggering). On-demand playbooks can be explicitly executed by authorized operators, distinct from event-driven automatic triggers. That mechanism does not satisfy this particular requirement: A SOC auditor requests evidence that a notification and ticket action ran for a critical case.

This configures a different design mechanism (Log Browse archive file investigation). Log Browse exposes stored log files, including compressed archive files, independently of indexed historical analytics queries. That mechanism does not satisfy this particular requirement: An analyst narrows a broad threat-hunting query to one user and compares related destinations over time.

This configures a different design mechanism (Local FortiAnalyzer administrative event logs). The analyzer's own event log records relevant administrative and system actions distinct from managed FortiGate traffic events. That mechanism does not satisfy this particular requirement: An analyst narrows a broad threat-hunting query to one user and compares related destinations over time.

This configures a different design mechanism (Intrusion prevention signature logs). IPS logging describes signature matches and prevention context, which can be reviewed alongside traffic records. That mechanism does not satisfy this particular requirement: An analyst narrows a broad threat-hunting query to one user and compares related destinations over time.

This observation tests Dataset $log log-type placeholder: Validate a test dataset query for the chosen log type and verify expected matching rows. It would be useful for that separate control but not as the decisive acceptance evidence for: A firewall forwards raw log archives but the security report consistently says No Data.

This observation tests ADOM-aware reporting scope: Run a test report from the intended tenant ADOM and verify that records from unrelated ADOMs are absent. It would be useful for that separate control but not as the decisive acceptance evidence for: A firewall forwards raw log archives but the security report consistently says No Data.

This observation tests Report macro for numeric summary: Run a report with known test data and verify its macro value matches the corresponding dataset aggregation. It would be useful for that separate control but not as the decisive acceptance evidence for: A firewall forwards raw log archives but the security report consistently says No Data.

The warning “Do not assume an old archive file automatically appears in the SQL-indexed analytics search window” addresses a different FortiAnalyzer risk. Its technical basis is: Log Browse exposes stored log files, including compressed archive files, independently of indexed historical analytics queries. For the current case the operative mechanism is: Web filtering can classify access to websites and record enforcement outcomes based on configured categories or URL rules. The relevant precaution is “Do not substitute a generic TCP 443 session log for a web-category policy decision without the web-filter fields”.

The warning “Do not confuse a saved filter with a scheduled alert that continuously monitors and notifies automatically” addresses a different FortiAnalyzer risk. Its technical basis is: Custom views and Favorites preserve suitable log query settings for later reuse without rebuilding each search from scratch. For the current case the operative mechanism is: Web filtering can classify access to websites and record enforcement outcomes based on configured categories or URL rules. The relevant precaution is “Do not substitute a generic TCP 443 session log for a web-category policy decision without the web-filter fields”.

The warning “Do not confuse the destination with the initiating source, and validate original versus translated NAT fields before taking action” addresses a different FortiAnalyzer risk. Its technical basis is: Network logs commonly distinguish initiating source IP from destination IP, but NAT or proxy translations can add other fields. For the current case the operative mechanism is: Web filtering can classify access to websites and record enforcement outcomes based on configured categories or URL rules. The relevant precaution is “Do not substitute a generic TCP 443 session log for a web-category policy decision without the web-filter fields”.

The warning “Do not claim that no attack occurred when the chosen log view includes only a five-minute window” addresses a different FortiAnalyzer risk. Its technical basis is: Historical analytics depends on indexed stored records while recent-event views may emphasize arriving log data. For the current case the operative mechanism is: Application identification can provide layer-seven context beyond network port or service number alone. The relevant precaution is “Do not infer application identity from destination TCP port alone when application-control logs are available”.

The warning “Do not treat a gray widget as proof that the product feature has been removed from the current release” addresses a different FortiAnalyzer risk. Its technical basis is: Some FortiView widgets require specific log types and available indexed data; absent inputs leave them unavailable. For the current case the operative mechanism is: Application identification can provide layer-seven context beyond network port or service number alone. The relevant precaution is “Do not infer application identity from destination TCP port alone when application-control logs are available”.

The warning “Do not interpret a top-destination chart as definitive evidence that the destination is malicious” addresses a different FortiAnalyzer risk. Its technical basis is: Destination analytics aggregates log-derived connections and volume toward target addresses or domains. For the current case the operative mechanism is: Application identification can provide layer-seven context beyond network port or service number alone. The relevant precaution is “Do not infer application identity from destination TCP port alone when application-control logs are available”.

This observation tests Custom report chart selection: Generate a chart with controlled sample values and verify labels and measures reflect the intended analysis. It would be useful for that separate control but not as the decisive acceptance evidence for: A chart needs a threat name but the dataset queries only normal traffic sessions.

This observation tests Group report versus per-device report: Generate a controlled group comparison and verify combined totals or distinct device sections as configured. It would be useful for that separate control but not as the decisive acceptance evidence for: A chart needs a threat name but the dataset queries only normal traffic sessions.

This observation tests Report output notification profile: Run a safe report and verify its configured recipient or destination receives the expected file notification. It would be useful for that separate control but not as the decisive acceptance evidence for: A chart needs a threat name but the dataset queries only normal traffic sessions.

The warning “Do not assume a report definition export includes historical analytic logs or every dependent object automatically” addresses a different FortiAnalyzer risk. Its technical basis is: Transferred definitions may reference datasets charts or templates that must exist and align with the target ADOM and version. For the current case the operative mechanism is: A chart's representation must match the dataset output, such as a time-series line or categorical bar chart. The relevant precaution is “Do not use a pie chart of raw timestamps when the question requires trend comparisons across hours”.

The warning “Do not state a report covers all branches when its source-device setting selects only headquarters” addresses a different FortiAnalyzer risk. Its technical basis is: Report settings constrain the population of source devices whose analytic records contribute to the output. For the current case the operative mechanism is: A chart's representation must match the dataset output, such as a time-series line or categorical bar chart. The relevant precaution is “Do not use a pie chart of raw timestamps when the question requires trend comparisons across hours”.

The warning “Do not enable heavy auto-cache for every low-value report without evaluating resource contention” addresses a different FortiAnalyzer risk. Its technical basis is: Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. For the current case the operative mechanism is: A chart's representation must match the dataset output, such as a time-series line or categorical bar chart. The relevant precaution is “Do not use a pie chart of raw timestamps when the question requires trend comparisons across hours”.

This observation tests Log storage quota and retention policy: Compare configured storage limits with actual daily ingestion and verify the oldest required records remain available. It would be useful for that separate control but not as the decisive acceptance evidence for: An audit requires firewall security events from a newly installed branch to be searchable centrally.

This observation tests Normalized log field quality: Inspect parsed record samples and compare normalized values with the corresponding raw source payload. It would be useful for that separate control but not as the decisive acceptance evidence for: An audit requires firewall security events from a newly installed branch to be searchable centrally.

This observation tests Device-to-ADOM assignment: Inspect the registered device's ADOM assignment and compare its events from the correct ADOM view. It would be useful for that separate control but not as the decisive acceptance evidence for: An audit requires firewall security events from a newly installed branch to be searchable centrally.

The rationale applies to a separate topic (Report auto-cache and hcache performance): Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. It does not explain the network-design constraint in: An incident report mixes a current-day chart with a previous-month executive count.

That reasoning fits a different technical topic (Report No Data troubleshooting and guidance): Missing source logs wrong device selection wrong fields or unavailable analytics can leave correctly designed report components empty. It does not explain the network-design constraint in: An incident report mixes a current-day chart with a previous-month executive count.

This explanation concerns another technical issue (Report macro for numeric summary): Macros reference datasets to populate text or numeric summaries such as counts and percentages in report layouts. It does not explain the network-design constraint in: An incident report mixes a current-day chart with a previous-month executive count.

This configures a different design mechanism (Antivirus and malware-detection event analysis). Security inspection logs can record detected malicious content and whether inspection blocked, quarantined, or otherwise handled it. That mechanism does not satisfy this particular requirement: A SOC analyst selects a one-hour source view to prioritize bandwidth investigations.

This configures a different design mechanism (Application control detection analysis). Application identification can provide layer-seven context beyond network port or service number alone. That mechanism does not satisfy this particular requirement: A SOC analyst selects a one-hour source view to prioritize bandwidth investigations.

This configures a different design mechanism (Log-count chart for anomaly investigation). Log-count visualization highlights changes in the number of log events but does not independently classify them as attacks. That mechanism does not satisfy this particular requirement: A SOC analyst selects a one-hour source view to prioritize bandwidth investigations.

This observation tests Log storage quota and retention policy: Compare configured storage limits with actual daily ingestion and verify the oldest required records remain available. It would be useful for that separate control but not as the decisive acceptance evidence for: A managed security provider needs separate log and report contexts for two customers.

This observation tests SOC automation content pack applicability: Verify the enabled content pack and confirm a selected supplemental rule or parser is available under the expected license. It would be useful for that separate control but not as the decisive acceptance evidence for: A managed security provider needs separate log and report contexts for two customers.

This observation tests Product-specific log categories in Security Fabric: Select the correct product or normalized source view and verify a representative event retains its source identity. It would be useful for that separate control but not as the decisive acceptance evidence for: A managed security provider needs separate log and report contexts for two customers.