The warning “Do not assume collecting only connection traffic logs also preserves full antivirus or administrative event history” addresses a different FortiAnalyzer risk. Its technical basis is: Traffic logs describe sessions, security logs describe inspection activity, and event logs describe system or operational changes. For the current case the operative mechanism is: Transport confidentiality and authentication reduce exposure of log content and unauthorized injection while logs move between devices. The relevant precaution is “Do not equate a reachable cleartext syslog port with authenticated end-to-end log transport confidentiality”.

The warning “Do not approve a parser solely because it matches one happy-path message while error variants remain unparsed” addresses a different FortiAnalyzer risk. Its technical basis is: Parser validation reveals missed fields and nonmatching patterns before they cause silent gaps in Fabric analytics. For the current case the operative mechanism is: Transport confidentiality and authentication reduce exposure of log content and unauthorized injection while logs move between devices. The relevant precaution is “Do not equate a reachable cleartext syslog port with authenticated end-to-end log transport confidentiality”.

The warning “Do not claim an operator viewing one ADOM automatically has equivalent access to every other administrative domain” addresses a different FortiAnalyzer risk. Its technical basis is: An ADOM is a logical administrative boundary whose device assignments and view context constrain relevant records. For the current case the operative mechanism is: Transport confidentiality and authentication reduce exposure of log content and unauthorized injection while logs move between devices. The relevant precaution is “Do not equate a reachable cleartext syslog port with authenticated end-to-end log transport confidentiality”.

This observation tests Automatic parser assignment: Filter Log View All by parser name and confirm matching records appear after the parser is enabled. It would be useful for that separate control but not as the decisive acceptance evidence for: An incident response team must request older data from a source that kept local logs while central forwarding failed.

This observation tests Log ingestion volume monitoring: Compare log volume statistics before and after a simulated firewall log burst and confirm expected counters respond. It would be useful for that separate control but not as the decisive acceptance evidence for: An incident response team must request older data from a source that kept local logs while central forwarding failed.

This observation tests Analytics versus Archive log storage: Check that a test event exists in the analytic view and that archive files remain accessible through their relevant log browse workflow. It would be useful for that separate control but not as the decisive acceptance evidence for: An incident response team must request older data from a source that kept local logs while central forwarding failed.

This configures a different design mechanism (Centralized FortiGate log collection). FortiAnalyzer centrally receives device records only when the source is configured to send the needed log types and the logging connection is usable. That mechanism does not satisfy this particular requirement: A compliance team retains compressed logs but a historic dataset query returns no matching analytic rows.

This configures a different design mechanism (Custom log parser for an unsupported source). A custom parser can recognize source record patterns and extract attributes into normalized analytic fields when correctly defined. That mechanism does not satisfy this particular requirement: A compliance team retains compressed logs but a historic dataset query returns no matching analytic rows.

This configures a different design mechanism (Historical log file retrieval). Log fetching obtains historical records as a separate process from waiting for new real-time log events. That mechanism does not satisfy this particular requirement: A compliance team retains compressed logs but a historic dataset query returns no matching analytic rows.

This configures a different design mechanism (Event escalation to incident). Events surface matching detections while incidents provide a broader case-management workflow for triage and investigation. That mechanism does not satisfy this particular requirement: A shift handover requires evidence references and remaining containment tasks on one incident.

This configures a different design mechanism (Playbook task dependency ordering). FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. That mechanism does not satisfy this particular requirement: A shift handover requires evidence references and remaining containment tasks on one incident.

This configures a different design mechanism (Incident severity and status triage). Incident metadata and chart filters help analysts manage queues but do not themselves validate the underlying detection. That mechanism does not satisfy this particular requirement: A shift handover requires evidence references and remaining containment tasks on one incident.

This configures a different design mechanism (Application control detection analysis). Application identification can provide layer-seven context beyond network port or service number alone. That mechanism does not satisfy this particular requirement: An older firewall event exists on disk as a compressed log file but not in historical FortiView.

This configures a different design mechanism (Threat hunting and iterative pivots). Threat hunting begins with a hypothesis or indicator and broadens through validated relationships rather than treating any one artifact as conclusive. That mechanism does not satisfy this particular requirement: An older firewall event exists on disk as a compressed log file but not in historical FortiView.

This configures a different design mechanism (Historical versus real-time log time selection). Historical analytics depends on indexed stored records while recent-event views may emphasize arriving log data. That mechanism does not satisfy this particular requirement: An older firewall event exists on disk as a compressed log file but not in historical FortiView.

This observation tests Device-to-ADOM assignment: Inspect the registered device's ADOM assignment and compare its events from the correct ADOM view. It would be useful for that separate control but not as the decisive acceptance evidence for: A report erroneously merges gateway traffic volume with email filtering events.

This observation tests Analytics versus Archive log storage: Check that a test event exists in the analytic view and that archive files remain accessible through their relevant log browse workflow. It would be useful for that separate control but not as the decisive acceptance evidence for: A report erroneously merges gateway traffic volume with email filtering events.

This observation tests SOC automation content pack applicability: Verify the enabled content pack and confirm a selected supplemental rule or parser is available under the expected license. It would be useful for that separate control but not as the decisive acceptance evidence for: A report erroneously merges gateway traffic volume with email filtering events.

The warning “Do not grant full appliance administrative rights merely so an analyst can acknowledge incidents” addresses a different FortiAnalyzer risk. Its technical basis is: Read-only viewing and read-write configuration privileges govern whether users can modify event handlers or playbooks. For the current case the operative mechanism is: Disk policy and quotas bound how long incoming logs and indexed data remain available under sustained log rates. The relevant precaution is “Do not guarantee a one-year search history with a disk quota that can only hold a few days of incoming traffic”.

The warning “Do not treat syntactically valid parsing as proof that all field mappings and event meanings are correct” addresses a different FortiAnalyzer risk. Its technical basis is: Consistent normalized field semantics prevent false joins between attributes that represent different event properties. For the current case the operative mechanism is: Disk policy and quotas bound how long incoming logs and indexed data remain available under sustained log rates. The relevant precaution is “Do not guarantee a one-year search history with a disk quota that can only hold a few days of incoming traffic”.

The warning “Do not promise FortiView investigative dashboards when the analyzer is configured only as a Collector” addresses a different FortiAnalyzer risk. Its technical basis is: Collector mode prioritizes log collection and forwarding; analytical GUI features such as FortiView are not available in Collector mode. For the current case the operative mechanism is: Disk policy and quotas bound how long incoming logs and indexed data remain available under sustained log rates. The relevant precaution is “Do not guarantee a one-year search history with a disk quota that can only hold a few days of incoming traffic”.

This explanation concerns another technical issue (Event escalation to incident): Events surface matching detections while incidents provide a broader case-management workflow for triage and investigation. It does not explain the network-design constraint in: An incident response case must be attached to a legal review ticket without sending the entire log database.

The rationale applies to a separate topic (Indicators attached to incidents): Indicators provide structured observable artifacts linked to an incident and may originate from event handlers or other inputs. It does not explain the network-design constraint in: An incident response case must be attached to a legal review ticket without sending the entire log database.

That reasoning fits a different technical topic (Playbook task dependency ordering): FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. It does not explain the network-design constraint in: An incident response case must be attached to a legal review ticket without sending the entire log database.

This configures a different design mechanism (Indicator reputation and enrichment workflow). Enrichment adds external context such as reputation to indicators but does not independently prove maliciousness. That mechanism does not satisfy this particular requirement: An analyst finds a vendor rule in the library and needs to activate it for one customer's ADOM.

This configures a different design mechanism (FortiAI assisted investigation review). AI-assisted narrative or query suggestions can accelerate investigation but do not replace analyst verification of underlying events. That mechanism does not satisfy this particular requirement: An analyst finds a vendor rule in the library and needs to activate it for one customer's ADOM.

This configures a different design mechanism (On-demand playbook triggering). On-demand playbooks can be explicitly executed by authorized operators, distinct from event-driven automatic triggers. That mechanism does not satisfy this particular requirement: An analyst finds a vendor rule in the library and needs to activate it for one customer's ADOM.

This observation tests Event handler data selector reuse: Verify a test event from a selected source matches while unrelated device logs are excluded. It would be useful for that separate control but not as the decisive acceptance evidence for: The SOC wants an event when either one malware verdict or one blocked command-and-control domain is detected.

This observation tests Indicator reputation and enrichment workflow: Run enrichment on a known test indicator and verify the connector result and enrichment status are captured. It would be useful for that separate control but not as the decisive acceptance evidence for: The SOC wants an event when either one malware verdict or one blocked command-and-control domain is detected.

This observation tests Predefined event handler enablement: Check the selected rule's enabled state and test a known matching event after activation. It would be useful for that separate control but not as the decisive acceptance evidence for: The SOC wants an event when either one malware verdict or one blocked command-and-control domain is detected.

This configures a different design mechanism (Handler log-source scope validation). Event logic can work syntactically while never seeing the required log population due to scope or input differences. That mechanism does not satisfy this particular requirement: An incident contains a playbook record whose final task was never executed.

This configures a different design mechanism (On-demand playbook triggering). On-demand playbooks can be explicitly executed by authorized operators, distinct from event-driven automatic triggers. That mechanism does not satisfy this particular requirement: An incident contains a playbook record whose final task was never executed.

This configures a different design mechanism (Playbook variable and output mapping). Playbook variables pass incident or task context between steps, avoiding hard-coded unrelated indicator values. That mechanism does not satisfy this particular requirement: An incident contains a playbook record whose final task was never executed.