This observation tests SOC automation content pack applicability: Verify the enabled content pack and confirm a selected supplemental rule or parser is available under the expected license. It would be useful for that separate control but not as the decisive acceptance evidence for: A regional analyzer has local logs but headquarters expects a forwarded security log feed.

This observation tests Administrative domain isolation: Switch between two authorized ADOMs and confirm each shows only its assigned devices and appropriate logs. It would be useful for that separate control but not as the decisive acceptance evidence for: A regional analyzer has local logs but headquarters expects a forwarded security log feed.

This observation tests FortiGate traffic and security and event categories: Generate test traffic and a test security event and verify both distinct log categories are collected and visible. It would be useful for that separate control but not as the decisive acceptance evidence for: A regional analyzer has local logs but headquarters expects a forwarded security log feed.

This observation tests Log storage quota and retention policy: Compare configured storage limits with actual daily ingestion and verify the oldest required records remain available. It would be useful for that separate control but not as the decisive acceptance evidence for: A parser update advertised in a FortiGuard extension cannot be installed in a lab without its entitlement.

This observation tests Product-specific log categories in Security Fabric: Select the correct product or normalized source view and verify a representative event retains its source identity. It would be useful for that separate control but not as the decisive acceptance evidence for: A parser update advertised in a FortiGuard extension cannot be installed in a lab without its entitlement.

This observation tests Windows and Linux endpoint log ingestion: Generate a harmless endpoint authentication event and confirm its parser and normalized host identity in Log View All. It would be useful for that separate control but not as the decisive acceptance evidence for: A parser update advertised in a FortiGuard extension cannot be installed in a lab without its entitlement.

This configures a different design mechanism (VPN authentication and connection logs). VPN session state and authentication outcomes offer identity context that ordinary IP traffic logs may lack. That mechanism does not satisfy this particular requirement: A SOC responder must distinguish enforcement drop events from normal completed sessions.

This configures a different design mechanism (Threat hunting and iterative pivots). Threat hunting begins with a hypothesis or indicator and broadens through validated relationships rather than treating any one artifact as conclusive. That mechanism does not satisfy this particular requirement: A SOC responder must distinguish enforcement drop events from normal completed sessions.

This configures a different design mechanism (Incident to raw-event pivot). Incident summaries group detections, but underlying log evidence is needed to verify identities, timing, and actions. That mechanism does not satisfy this particular requirement: A SOC responder must distinguish enforcement drop events from normal completed sessions.

The warning “Do not assume a macro containing a static typed value updates automatically with each report run” addresses a different FortiAnalyzer risk. Its technical basis is: Macros reference datasets to populate text or numeric summaries such as counts and percentages in report layouts. For the current case the operative mechanism is: Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. The relevant precaution is “Do not enable heavy auto-cache for every low-value report without evaluating resource contention”.

The warning “Do not assume creating a chart in the library automatically inserts it into every report template” addresses a different FortiAnalyzer risk. Its technical basis is: Report layout templates arrange charts, macros, text, and images while underlying datasets supply their values. For the current case the operative mechanism is: Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. The relevant precaution is “Do not enable heavy auto-cache for every low-value report without evaluating resource contention”.

The warning “Do not state a report covers all branches when its source-device setting selects only headquarters” addresses a different FortiAnalyzer risk. Its technical basis is: Report settings constrain the population of source devices whose analytic records contribute to the output. For the current case the operative mechanism is: Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. The relevant precaution is “Do not enable heavy auto-cache for every low-value report without evaluating resource contention”.

That reasoning fits a different technical topic (Playbook export and import compatibility): Playbook portability can move workflow definitions but environmental credentials and available connectors still require local validation. It does not explain the network-design constraint in: A SOC run executes remediation before identity lookup because tasks were arranged incorrectly.

This explanation concerns another technical issue (Incident evidence export): Incident export produces a documented summary and selected event material for external review without replacing retained raw logs. It does not explain the network-design constraint in: A SOC run executes remediation before identity lookup because tasks were arranged incorrectly.

The rationale applies to a separate topic (Playbook execution history and monitoring): Playbook histories distinguish configured intent from executed tasks and their successes or failures. It does not explain the network-design constraint in: A SOC run executes remediation before identity lookup because tasks were arranged incorrectly.

This explanation concerns another technical issue (Playbook task dependency ordering): FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. It does not explain the network-design constraint in: An event handler is producing alerts from either of its rules and the SOC must explain the logic.

The rationale applies to a separate topic (Incident notes and analyst context): Case notes preserve human triage context while source logs remain separate evidence of observed activity. It does not explain the network-design constraint in: An event handler is producing alerts from either of its rules and the SOC must explain the logic.

That reasoning fits a different technical topic (Event handler data selector reuse): Data selectors scope which collected logs enter downstream event-handler evaluation rather than serving as notification destinations. It does not explain the network-design constraint in: An event handler is producing alerts from either of its rules and the SOC must explain the logic.

The warning “Do not change only a chart title and assume its underlying SQL dataset is now querying different events” addresses a different FortiAnalyzer risk. Its technical basis is: Charts render selected dataset outputs in suitable table or graph formats; the chart does not define source log collection by itself. For the current case the operative mechanism is: Report results are constrained by selected periods and data availability; incorrect range choices can omit relevant events. The relevant precaution is “Do not claim an empty report disproves an attack before checking time range and log retention”.

The warning “Do not use a pie chart of raw timestamps when the question requires trend comparisons across hours” addresses a different FortiAnalyzer risk. Its technical basis is: A chart's representation must match the dataset output, such as a time-series line or categorical bar chart. For the current case the operative mechanism is: Report results are constrained by selected periods and data availability; incorrect range choices can omit relevant events. The relevant precaution is “Do not claim an empty report disproves an attack before checking time range and log retention”.

The warning “Do not enable heavy auto-cache for every low-value report without evaluating resource contention” addresses a different FortiAnalyzer risk. Its technical basis is: Auto-cache creates or maintains intermediate query results that can shorten report generation at the cost of compute and storage. For the current case the operative mechanism is: Report results are constrained by selected periods and data availability; incorrect range choices can omit relevant events. The relevant precaution is “Do not claim an empty report disproves an attack before checking time range and log retention”.

That reasoning fits a different technical topic (Custom log parser for an unsupported source): A custom parser can recognize source record patterns and extract attributes into normalized analytic fields when correctly defined. It does not explain the network-design constraint in: Analysts see a newly onboarded device in Device Manager but cannot find it in customer reports.

This explanation concerns another technical issue (Transport protection for remote log delivery): Transport confidentiality and authentication reduce exposure of log content and unauthorized injection while logs move between devices. It does not explain the network-design constraint in: Analysts see a newly onboarded device in Device Manager but cannot find it in customer reports.

The rationale applies to a separate topic (Analytics versus Archive log storage): Analytics logs are indexed for database-backed searches and reports, whereas archive records preserve received log files for archival workflows. It does not explain the network-design constraint in: Analysts see a newly onboarded device in Device Manager but cannot find it in customer reports.

This observation tests Group report versus per-device report: Generate a controlled group comparison and verify combined totals or distinct device sections as configured. It would be useful for that separate control but not as the decisive acceptance evidence for: An analyst enables dozens of auto-cache jobs and notices increased analyzer workload.

This observation tests Report source-device selection: Compare controlled activity on an included device and an excluded device in a test report. It would be useful for that separate control but not as the decisive acceptance evidence for: An analyst enables dozens of auto-cache jobs and notices increased analyzer workload.

This observation tests Scheduled report execution: Verify the configured run schedule and confirm a controlled scheduled job generates an output file. It would be useful for that separate control but not as the decisive acceptance evidence for: An analyst enables dozens of auto-cache jobs and notices increased analyzer workload.

This configures a different design mechanism (Indicator type and value management). Indicator typing helps enrichment and subsequent searches interpret an artifact appropriately. That mechanism does not satisfy this particular requirement: A SOC dashboard shows many unassigned high-severity incidents requiring prioritized ownership.

This configures a different design mechanism (Incident notes and analyst context). Case notes preserve human triage context while source logs remain separate evidence of observed activity. That mechanism does not satisfy this particular requirement: A SOC dashboard shows many unassigned high-severity incidents requiring prioritized ownership.

This configures a different design mechanism (Incident evidence export). Incident export produces a documented summary and selected event material for external review without replacing retained raw logs. That mechanism does not satisfy this particular requirement: A SOC dashboard shows many unassigned high-severity incidents requiring prioritized ownership.

This configures a different design mechanism (Local FortiAnalyzer administrative event logs). The analyzer's own event log records relevant administrative and system actions distinct from managed FortiGate traffic events. That mechanism does not satisfy this particular requirement: A suspicious outbound connection must be traced to the correct workstation behind source NAT.

This configures a different design mechanism (Log-count chart for anomaly investigation). Log-count visualization highlights changes in the number of log events but does not independently classify them as attacks. That mechanism does not satisfy this particular requirement: A suspicious outbound connection must be traced to the correct workstation behind source NAT.

This configures a different design mechanism (Application control detection analysis). Application identification can provide layer-seven context beyond network port or service number alone. That mechanism does not satisfy this particular requirement: A suspicious outbound connection must be traced to the correct workstation behind source NAT.