This observation tests Event notification profile routing: Trigger a safe test match and confirm its notification reaches the approved SOC destination. It would be useful for that separate control but not as the decisive acceptance evidence for: An analyst configures a playbook to run a FortiGate response but no matching FortiOS automation rule exists.

This observation tests Playbook task dependency ordering: Run a test playbook and inspect the execution graph to confirm prerequisite tasks finish before dependent actions. It would be useful for that separate control but not as the decisive acceptance evidence for: An analyst configures a playbook to run a FortiGate response but no matching FortiOS automation rule exists.

This observation tests On-demand playbook triggering: Execute the test playbook manually and confirm one run is recorded without unrelated automatic runs. It would be useful for that separate control but not as the decisive acceptance evidence for: An analyst configures a playbook to run a FortiGate response but no matching FortiOS automation rule exists.

This configures a different design mechanism (Correlation handler combined conditions). Correlation handlers evaluate sets of rules using operators such as AND, AND_NOT, OR and temporal sequence conditions. That mechanism does not satisfy this particular requirement: A response task times out because the security appliance connector is not enabled for the intended action.

This configures a different design mechanism (Playbook task dependency ordering). FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. That mechanism does not satisfy this particular requirement: A response task times out because the security appliance connector is not enabled for the intended action.

This configures a different design mechanism (On-demand playbook triggering). On-demand playbooks can be explicitly executed by authorized operators, distinct from event-driven automatic triggers. That mechanism does not satisfy this particular requirement: A response task times out because the security appliance connector is not enabled for the intended action.

This observation tests Web filter category and URL events: Browse a known allowed and blocked category in a controlled test and compare recorded verdicts. It would be useful for that separate control but not as the decisive acceptance evidence for: A firewall IP alert and a Linux host event need correlation within a single narrow time window.

This observation tests Antivirus and malware-detection event analysis: Use a benign supported test detection and verify log category threat name and enforcement action. It would be useful for that separate control but not as the decisive acceptance evidence for: A firewall IP alert and a Linux host event need correlation within a single narrow time window.

This observation tests Log group filtering across devices: Verify that a filter over the group returns matching records from all intended member devices but not excluded firewalls. It would be useful for that separate control but not as the decisive acceptance evidence for: A firewall IP alert and a Linux host event need correlation within a single narrow time window.

That reasoning fits a different technical topic (Playbook task dependency ordering): FortiAnalyzer playbook tasks execute within a trigger-based workflow according to predecessor completion and task connections. It does not explain the network-design constraint in: A natural-language query identifies a high-risk IP but the analyst must verify scope and timestamps.

This explanation concerns another technical issue (Generic text filter syntax for handlers): Generic Text Filter predicates match fields or text using documented comparison and pattern operators and require escaping special characters when applicable. It does not explain the network-design constraint in: A natural-language query identifies a high-risk IP but the analyst must verify scope and timestamps.

The rationale applies to a separate topic (Playbook connector authorization and scope): Connectors mediate external services and their authentication or permissions affect what playbook tasks can execute. It does not explain the network-design constraint in: A natural-language query identifies a high-risk IP but the analyst must verify scope and timestamps.

This observation tests Normalized Fabric log model: Inspect the same normalized source or destination attribute across two supported device log parsers in Log View All. It would be useful for that separate control but not as the decisive acceptance evidence for: An administrator mistakenly assumes selecting store-and-upload gives the same latency as a real-time log stream.

This observation tests Role-based SOC permissions: Sign in as a delegated analyst and verify authorized investigation works while unauthorized automation edits are denied. It would be useful for that separate control but not as the decisive acceptance evidence for: An administrator mistakenly assumes selecting store-and-upload gives the same latency as a real-time log stream.

This observation tests Automatic parser assignment: Filter Log View All by parser name and confirm matching records appear after the parser is enabled. It would be useful for that separate control but not as the decisive acceptance evidence for: An administrator mistakenly assumes selecting store-and-upload gives the same latency as a real-time log stream.

This observation tests Incident notes and analyst context: Confirm an authorized analyst comment appears on the intended case without changing source log values. It would be useful for that separate control but not as the decisive acceptance evidence for: An event rule searches a raw cfgpath with embedded periods and fails because the filter is not escaped.

This observation tests Basic event handler OR-rule logic: Test each configured rule separately and confirm it creates the intended event under the correct scope. It would be useful for that separate control but not as the decisive acceptance evidence for: An event rule searches a raw cfgpath with embedded periods and fails because the filter is not escaped.

This observation tests Absence-aware NOT_FOLLOWED_BY correlation: Generate a first log with no follow-up and compare it to a control sequence containing the expected follow-up. It would be useful for that separate control but not as the decisive acceptance evidence for: An event rule searches a raw cfgpath with embedded periods and fails because the filter is not escaped.

That reasoning fits a different technical topic (VPN authentication and connection logs): VPN session state and authentication outcomes offer identity context that ordinary IP traffic logs may lack. It does not explain the network-design constraint in: A FortiGate traffic log shows a session but no malware verdict because AV logging was omitted.

This explanation concerns another technical issue (Saved custom log views and Favorites): Custom views and Favorites preserve suitable log query settings for later reuse without rebuilding each search from scratch. It does not explain the network-design constraint in: A FortiGate traffic log shows a session but no malware verdict because AV logging was omitted.

The rationale applies to a separate topic (Source and destination IP field interpretation): Network logs commonly distinguish initiating source IP from destination IP, but NAT or proxy translations can add other fields. It does not explain the network-design constraint in: A FortiGate traffic log shows a session but no malware verdict because AV logging was omitted.

The warning “Do not treat blank report output in the wrong ADOM as proof that an assigned firewall never logged an event” addresses a different FortiAnalyzer risk. Its technical basis is: The ADOM context governs report definitions and which assigned device logs are available to the report. For the current case the operative mechanism is: Missing source logs wrong device selection wrong fields or unavailable analytics can leave correctly designed report components empty. The relevant precaution is “Do not rebuild the report template blindly when no relevant input log records exist for the queried period”.

The warning “Do not assume saving a report automatically schedules periodic output or sends it to recipients” addresses a different FortiAnalyzer risk. Its technical basis is: Report scheduling defines when an existing report configuration executes, separate from notification or dataset creation. For the current case the operative mechanism is: Missing source logs wrong device selection wrong fields or unavailable analytics can leave correctly designed report components empty. The relevant precaution is “Do not rebuild the report template blindly when no relevant input log records exist for the queried period”.

The warning “Do not change only a chart title and assume its underlying SQL dataset is now querying different events” addresses a different FortiAnalyzer risk. Its technical basis is: Charts render selected dataset outputs in suitable table or graph formats; the chart does not define source log collection by itself. For the current case the operative mechanism is: Missing source logs wrong device selection wrong fields or unavailable analytics can leave correctly designed report components empty. The relevant precaution is “Do not rebuild the report template blindly when no relevant input log records exist for the queried period”.

This configures a different design mechanism (ADOM-aware reporting scope). The ADOM context governs report definitions and which assigned device logs are available to the report. That mechanism does not satisfy this particular requirement: A chart reports destinations but the data is grouped by sources and labels are misleading.

This configures a different design mechanism (Dataset log field availability validation). SQL reports can fail or return empty data if required fields are unavailable or mapped differently in the selected log source. That mechanism does not satisfy this particular requirement: A chart reports destinations but the data is grouped by sources and labels are misleading.

This configures a different design mechanism (SQL dataset creation for reports). Datasets query indexed Analytics log data and feed charts or macros when a report is generated. That mechanism does not satisfy this particular requirement: A chart reports destinations but the data is grouped by sources and labels are misleading.

This configures a different design mechanism (Incident severity and status triage). Incident metadata and chart filters help analysts manage queues but do not themselves validate the underlying detection. That mechanism does not satisfy this particular requirement: Two regional SOCs want to standardize an incident-enrichment workflow using exported playbook definitions.

This configures a different design mechanism (On-demand playbook triggering). On-demand playbooks can be explicitly executed by authorized operators, distinct from event-driven automatic triggers. That mechanism does not satisfy this particular requirement: Two regional SOCs want to standardize an incident-enrichment workflow using exported playbook definitions.

This configures a different design mechanism (Playbook variable and output mapping). Playbook variables pass incident or task context between steps, avoiding hard-coded unrelated indicator values. That mechanism does not satisfy this particular requirement: Two regional SOCs want to standardize an incident-enrichment workflow using exported playbook definitions.

This configures a different design mechanism (Incident notes and analyst context). Case notes preserve human triage context while source logs remain separate evidence of observed activity. That mechanism does not satisfy this particular requirement: The SOC wants to assign responsibility for a correlated privileged-access alert.

This configures a different design mechanism (Event suppression for duplicate noise). Suppression reduces repeated related alerts according to defined criteria while original evidence may still need independent review. That mechanism does not satisfy this particular requirement: The SOC wants to assign responsibility for a correlated privileged-access alert.

This configures a different design mechanism (Outbreak-related incident triage). Outbreak information provides contextual intelligence and correlated detection signals that should be checked against the organization's observed logs. That mechanism does not satisfy this particular requirement: The SOC wants to assign responsibility for a correlated privileged-access alert.