This observation tests FortiView source hosts and talkers: Confirm a controlled high-volume source appears among top talkers when the relevant logs and time window include it. It would be useful for that separate control but not as the decisive acceptance evidence for: An auditor seeks evidence that gambling-category URLs were blocked by the perimeter filter.

This observation tests Dashboard widget prerequisites and blank states: Check the widget's required log information and generate a supported test event to validate population. It would be useful for that separate control but not as the decisive acceptance evidence for: An auditor seeks evidence that gambling-category URLs were blocked by the perimeter filter.

This observation tests Log Browse archive file investigation: Locate a known older compressed file and confirm its time span and source device before drawing conclusions. It would be useful for that separate control but not as the decisive acceptance evidence for: An auditor seeks evidence that gambling-category URLs were blocked by the perimeter filter.

This configures a different design mechanism (Playbook connector authorization and scope). Connectors mediate external services and their authentication or permissions affect what playbook tasks can execute. That mechanism does not satisfy this particular requirement: A lab wants to demonstrate enrichment of a test URL through the supported reputation provider.

This configures a different design mechanism (Correlation handler combined conditions). Correlation handlers evaluate sets of rules using operators such as AND, AND_NOT, OR and temporal sequence conditions. That mechanism does not satisfy this particular requirement: A lab wants to demonstrate enrichment of a test URL through the supported reputation provider.

This configures a different design mechanism (Incident evidence export). Incident export produces a documented summary and selected event material for external review without replacing retained raw logs. That mechanism does not satisfy this particular requirement: A lab wants to demonstrate enrichment of a test URL through the supported reputation provider.

That reasoning fits a different technical topic (Report result export and format selection): Rendered PDF or other supported report output presents report components but is not a substitute for the underlying log evidence. It does not explain the network-design constraint in: An analyst changes a template but forgets that the scheduled report still uses an older configuration.

This explanation concerns another technical issue (Report auto-cache and hcache performance): Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. It does not explain the network-design constraint in: An analyst changes a template but forgets that the scheduled report still uses an older configuration.

The rationale applies to a separate topic (Custom report chart selection): A chart's representation must match the dataset output, such as a time-series line or categorical bar chart. It does not explain the network-design constraint in: An analyst changes a template but forgets that the scheduled report still uses an older configuration.

This observation tests Intrusion prevention signature logs: Confirm a controlled IPS test produces the expected signature and action fields in the security log. It would be useful for that separate control but not as the decisive acceptance evidence for: A change review asks who modified a local analyzer setting, not who changed the FortiGate policy.

This observation tests Firewall action allow deny and session outcome: Correlate a known permitted session and a known denied attempt with their distinct action fields. It would be useful for that separate control but not as the decisive acceptance evidence for: A change review asks who modified a local analyzer setting, not who changed the FortiGate policy.

This observation tests Threat hunting and iterative pivots: Start from a known test IP indicator, pivot to related activity, and verify each link with timestamps and log details. It would be useful for that separate control but not as the decisive acceptance evidence for: A change review asks who modified a local analyzer setting, not who changed the FortiGate policy.

This configures a different design mechanism (Playbook task dependency ordering). FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. That mechanism does not satisfy this particular requirement: A correlation handler must detect a missing confirmation event while avoiding false alerts during collector outages.

This configures a different design mechanism (Playbook variable and output mapping). Playbook variables pass incident or task context between steps, avoiding hard-coded unrelated indicator values. That mechanism does not satisfy this particular requirement: A correlation handler must detect a missing confirmation event while avoiding false alerts during collector outages.

This configures a different design mechanism (Playbook export and import compatibility). Playbook portability can move workflow definitions but environmental credentials and available connectors still require local validation. That mechanism does not satisfy this particular requirement: A correlation handler must detect a missing confirmation event while avoiding false alerts during collector outages.

This observation tests FortiAI assisted investigation review: Compare an AI-generated incident explanation with linked source logs before documenting a final case verdict. It would be useful for that separate control but not as the decisive acceptance evidence for: An event handler is producing alerts from either of its rules and the SOC must explain the logic.

This observation tests Indicator type and value management: Create separate harmless test IP and URL indicators and verify each retains its correct type and value in the indicator table. It would be useful for that separate control but not as the decisive acceptance evidence for: An event handler is producing alerts from either of its rules and the SOC must explain the logic.

This observation tests Event handler data selector reuse: Verify a test event from a selected source matches while unrelated device logs are excluded. It would be useful for that separate control but not as the decisive acceptance evidence for: An event handler is producing alerts from either of its rules and the SOC must explain the logic.

This observation tests FortiView destination summaries: Compare one known destination in the traffic logs with its observed destination ranking in FortiView. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC sees HTTPS traffic to a suspicious domain and needs relevant web-filter category context.

This observation tests Log-count chart for anomaly investigation: Inject a controlled burst of supported events and verify the corresponding count curve rises in the selected interval. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC sees HTTPS traffic to a suspicious domain and needs relevant web-filter category context.

This observation tests Log group filtering across devices: Verify that a filter over the group returns matching records from all intended member devices but not excluded firewalls. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC sees HTTPS traffic to a suspicious domain and needs relevant web-filter category context.

The warning “Do not grant full appliance administrative rights merely so an analyst can acknowledge incidents” addresses a different FortiAnalyzer risk. Its technical basis is: Read-only viewing and read-write configuration privileges govern whether users can modify event handlers or playbooks. For the current case the operative mechanism is: FortiAnalyzer SIEM can ingest supported host event formats through Fabric Agent or compatible logging methods and normalize recognized records. The relevant precaution is “Do not assume every operating-system event becomes searchable centrally without a configured agent or recognized source parser”.

The warning “Do not promise entitlement-dependent FortiGuard SOC content to an unlicensed deployment” addresses a different FortiAnalyzer risk. Its technical basis is: Supplemental predefined detection content and parsers can depend on an active security automation service entitlement. For the current case the operative mechanism is: FortiAnalyzer SIEM can ingest supported host event formats through Fabric Agent or compatible logging methods and normalize recognized records. The relevant precaution is “Do not assume every operating-system event becomes searchable centrally without a configured agent or recognized source parser”.

The warning “Do not assume a raw vendor-specific property name is necessarily the normalized field name in a SIEM database query” addresses a different FortiAnalyzer risk. Its technical basis is: Normalization maps different raw field names and formats into common analytic attributes so cross-source comparisons are meaningful. For the current case the operative mechanism is: FortiAnalyzer SIEM can ingest supported host event formats through Fabric Agent or compatible logging methods and normalize recognized records. The relevant precaution is “Do not assume every operating-system event becomes searchable centrally without a configured agent or recognized source parser”.

This observation tests Dashboard widget prerequisites and blank states: Check the widget's required log information and generate a supported test event to validate population. It would be useful for that separate control but not as the decisive acceptance evidence for: A dashboard shows activity today but the auditor wants evidence from the previous calendar month.

This observation tests Log Browse archive file investigation: Locate a known older compressed file and confirm its time span and source device before drawing conclusions. It would be useful for that separate control but not as the decisive acceptance evidence for: A dashboard shows activity today but the auditor wants evidence from the previous calendar month.

This observation tests Normalized log search in Log View All: Run a normalized source-IP filter and confirm results include the expected records from multiple supported source types. It would be useful for that separate control but not as the decisive acceptance evidence for: A dashboard shows activity today but the auditor wants evidence from the previous calendar month.

This observation tests Group report versus per-device report: Generate a controlled group comparison and verify combined totals or distinct device sections as configured. It would be useful for that separate control but not as the decisive acceptance evidence for: A large monthly report spends hours recalculating similar security counts.

This observation tests Report definition import and export: Import a test report and inspect all linked datasets and chart objects before approving it for production. It would be useful for that separate control but not as the decisive acceptance evidence for: A large monthly report spends hours recalculating similar security counts.

This observation tests Report layout with inserted charts: Generate a test report and confirm the chart appears in the expected section with populated data. It would be useful for that separate control but not as the decisive acceptance evidence for: A large monthly report spends hours recalculating similar security counts.

This configures a different design mechanism (VPN authentication and connection logs). VPN session state and authentication outcomes offer identity context that ordinary IP traffic logs may lack. That mechanism does not satisfy this particular requirement: A server maintenance window creates a large event spike and analysts must distinguish expected from malicious causes.

This configures a different design mechanism (Network protocol and port correlation). Port numbers describe service endpoints only in the context of the transport protocol and actual application detection. That mechanism does not satisfy this particular requirement: A server maintenance window creates a large event spike and analysts must distinguish expected from malicious causes.

This configures a different design mechanism (Native Fortinet Logs source-format investigation). The Fortinet Logs view preserves product-oriented log types and fields that can differ from normalized Fabric representations. That mechanism does not satisfy this particular requirement: A server maintenance window creates a large event spike and analysts must distinguish expected from malicious causes.