This configures a different design mechanism (Log-count chart for anomaly investigation). Log-count visualization highlights changes in the number of log events but does not independently classify them as attacks. That mechanism does not satisfy this particular requirement: A monitor pane has no data despite healthy traffic logs because its required security log type is disabled.

This configures a different design mechanism (Antivirus and malware-detection event analysis). Security inspection logs can record detected malicious content and whether inspection blocked, quarantined, or otherwise handled it. That mechanism does not satisfy this particular requirement: A monitor pane has no data despite healthy traffic logs because its required security log type is disabled.

This configures a different design mechanism (Web filter category and URL events). Web filtering can classify access to websites and record enforcement outcomes based on configured categories or URL rules. That mechanism does not satisfy this particular requirement: A monitor pane has no data despite healthy traffic logs because its required security log type is disabled.

This observation tests Centralized FortiGate log collection: Confirm a controlled FortiGate traffic event appears on FortiAnalyzer under the expected device and log category. It would be useful for that separate control but not as the decisive acceptance evidence for: An auditor asks how the SOC prevents unapproved sources from injecting fabricated security records.

This observation tests Custom log parser for an unsupported source: Replay a controlled source log and verify that the custom parser extracts the intended normalized fields. It would be useful for that separate control but not as the decisive acceptance evidence for: An auditor asks how the SOC prevents unapproved sources from injecting fabricated security records.

This observation tests Normalized Fabric log model: Inspect the same normalized source or destination attribute across two supported device log parsers in Log View All. It would be useful for that separate control but not as the decisive acceptance evidence for: An auditor asks how the SOC prevents unapproved sources from injecting fabricated security records.

The warning “Do not set an unrestricted automatic trigger for a destructive containment action that requires human approval” addresses a different FortiAnalyzer risk. Its technical basis is: On-demand playbooks can be explicitly executed by authorized operators, distinct from event-driven automatic triggers. For the current case the operative mechanism is: Fabric automation links analyzer-driven detections or playbooks with authorized FortiOS actions through configured integration paths. The relevant precaution is “Do not assume adding a FortiGate device alone automatically authorizes every FortiOS security automation action”.

The warning “Do not assume a VirusTotal reputation column is fully populated on a system with no working connector” addresses a different FortiAnalyzer risk. Its technical basis is: FortiAnalyzer's enrichment workflow uses configured external connectors for optional reputation data and can show unavailable results without them. For the current case the operative mechanism is: Fabric automation links analyzer-driven detections or playbooks with authorized FortiOS actions through configured integration paths. The relevant precaution is “Do not assume adding a FortiGate device alone automatically authorizes every FortiOS security automation action”.

The warning “Do not send a block action before an upstream lookup has produced the indicator it requires” addresses a different FortiAnalyzer risk. Its technical basis is: FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. For the current case the operative mechanism is: Fabric automation links analyzer-driven detections or playbooks with authorized FortiOS actions through configured integration paths. The relevant precaution is “Do not assume adding a FortiGate device alone automatically authorizes every FortiOS security automation action”.

This explanation concerns another technical issue (Role-based SOC permissions): Read-only viewing and read-write configuration privileges govern whether users can modify event handlers or playbooks. It does not explain the network-design constraint in: Analysts see older compressed files in Log Browse but not in the historical analytics timeline.

The rationale applies to a separate topic (Parser validation with sample logs): Parser validation reveals missed fields and nonmatching patterns before they cause silent gaps in Fabric analytics. It does not explain the network-design constraint in: Analysts see older compressed files in Log Browse but not in the historical analytics timeline.

That reasoning fits a different technical topic (Historical log file retrieval): Log fetching obtains historical records as a separate process from waiting for new real-time log events. It does not explain the network-design constraint in: Analysts see older compressed files in Log Browse but not in the historical analytics timeline.

The rationale applies to a separate topic (Custom log parser for an unsupported source): A custom parser can recognize source record patterns and extract attributes into normalized analytic fields when correctly defined. It does not explain the network-design constraint in: An audit requires firewall security events from a newly installed branch to be searchable centrally.

That reasoning fits a different technical topic (Parser validation with sample logs): Parser validation reveals missed fields and nonmatching patterns before they cause silent gaps in Fabric analytics. It does not explain the network-design constraint in: An audit requires firewall security events from a newly installed branch to be searchable centrally.

This explanation concerns another technical issue (Log ingestion volume monitoring): Ingestion rate and disk growth provide operational evidence that source logging and retention capacity are changing. It does not explain the network-design constraint in: An audit requires firewall security events from a newly installed branch to be searchable centrally.

This observation tests Log ingestion volume monitoring: Compare log volume statistics before and after a simulated firewall log burst and confirm expected counters respond. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC needs to delegate investigation to customer-specific analysts without exposing unrelated logs.

This observation tests Centralized FortiGate log collection: Confirm a controlled FortiGate traffic event appears on FortiAnalyzer under the expected device and log category. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC needs to delegate investigation to customer-specific analysts without exposing unrelated logs.

This observation tests Custom log parser for an unsupported source: Replay a controlled source log and verify that the custom parser extracts the intended normalized fields. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC needs to delegate investigation to customer-specific analysts without exposing unrelated logs.

This explanation concerns another technical issue (Role-based SOC permissions): Read-only viewing and read-write configuration privileges govern whether users can modify event handlers or playbooks. It does not explain the network-design constraint in: A Windows authentication failure never appears in the SOC database despite the host having local Event Viewer records.

The rationale applies to a separate topic (SOC automation content pack applicability): Supplemental predefined detection content and parsers can depend on an active security automation service entitlement. It does not explain the network-design constraint in: A Windows authentication failure never appears in the SOC database despite the host having local Event Viewer records.

That reasoning fits a different technical topic (Transport protection for remote log delivery): Transport confidentiality and authentication reduce exposure of log content and unauthorized injection while logs move between devices. It does not explain the network-design constraint in: A Windows authentication failure never appears in the SOC database despite the host having local Event Viewer records.

This configures a different design mechanism (Report time-window configuration). Report results are constrained by selected periods and data availability; incorrect range choices can omit relevant events. That mechanism does not satisfy this particular requirement: An analyst exports a report but chart labels are clipped and its page layout needs verification.

This configures a different design mechanism (Report macro for numeric summary). Macros reference datasets to populate text or numeric summaries such as counts and percentages in report layouts. That mechanism does not satisfy this particular requirement: An analyst exports a report but chart labels are clipped and its page layout needs verification.

This configures a different design mechanism (Report source-device selection). Report settings constrain the population of source devices whose analytic records contribute to the output. That mechanism does not satisfy this particular requirement: An analyst exports a report but chart labels are clipped and its page layout needs verification.

This observation tests Time zones and event timestamp context: Compare the timestamp of a controlled event on the source with its normalized timestamp and analyst display time. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC engineer upgrades a third-party product and must test parser compatibility before an event-handler rollout.

This observation tests Windows and Linux endpoint log ingestion: Generate a harmless endpoint authentication event and confirm its parser and normalized host identity in Log View All. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC engineer upgrades a third-party product and must test parser compatibility before an event-handler rollout.

This observation tests SOC automation content pack applicability: Verify the enabled content pack and confirm a selected supplemental rule or parser is available under the expected license. It would be useful for that separate control but not as the decisive acceptance evidence for: A SOC engineer upgrades a third-party product and must test parser compatibility before an event-handler rollout.

This configures a different design mechanism (Native Fortinet Logs source-format investigation). The Fortinet Logs view preserves product-oriented log types and fields that can differ from normalized Fabric representations. That mechanism does not satisfy this particular requirement: Several perimeter firewalls protect one application and need a joint incident search.

This configures a different design mechanism (SIEM log analytics table correlations). SIEM analysis uses indexed normalized records to explore related host network and detection fields within the same investigative context. That mechanism does not satisfy this particular requirement: Several perimeter firewalls protect one application and need a joint incident search.

This configures a different design mechanism (Normalized log search in Log View All). The All pane uses normalized SIEM logs and can reveal related records from heterogeneous products in one analytic view. That mechanism does not satisfy this particular requirement: Several perimeter firewalls protect one application and need a joint incident search.

This observation tests Threat hunting and iterative pivots: Start from a known test IP indicator, pivot to related activity, and verify each link with timestamps and log details. It would be useful for that separate control but not as the decisive acceptance evidence for: An SOC administrator needs evidence of API access to the FortiAnalyzer management interface.

This observation tests Policy identifier and enforcement context: Match the policy ID in a controlled traffic log to the active firewall policy and confirm the intended decision. It would be useful for that separate control but not as the decisive acceptance evidence for: An SOC administrator needs evidence of API access to the FortiAnalyzer management interface.

This observation tests Native Fortinet Logs source-format investigation: Open the expected Fortinet product icon and log type and confirm the raw field values match the source event. It would be useful for that separate control but not as the decisive acceptance evidence for: An SOC administrator needs evidence of API access to the FortiAnalyzer management interface.