Fortinet FortiAnalyzer 7.6 Analyst (FCP_FAZ_AN-7.6)

On FortiAnalyzer, automation connectors allow playbooks to interact with external systems. For the FortiOS connector specifically:

The available actions are not predefined in FortiAnalyzer.

With a valid SOC Automation service license, FortiAnalyzer automatically downloads content updates for several modules to enhance its Security Operations Center capabilities. These include:

• Event Handlers: These are rules that define how FortiAnalyzer processes incoming events, triggering specific actions, often in conjunction with playbooks. Fortinet provides updated event handlers to address new threats and improve detection.
• Playbooks: These are automated workflows designed to standardize and accelerate incident response and security operations tasks. The SOC Automation service ensures that FortiAnalyzer has the latest playbooks for effective automation.
• Incident Templates: These templates provide standardized forms for creating and managing security incidents, ensuring consistent information gathering and reporting. Fortinet regularly updates these templates to reflect best practices and emerging incident types.

The other options are not primarily associated with automatic content downloads under the SOC Automation service. Report templates and dashboards are typically part of the standard FortiGuard Analysis and Management subscription, and while FortiAnalyzer uses connectors, 'Active Connectors' as a content module for updates via SOC Automation is not accurate.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/526786/fortianalyzer-soc-automation-service-subscription-and-license

The exhibit displays a log entry in a key-value pair format (e.g., adom_oid=198, src_ip=10.0.13.125).
✅ Option A: This is a formatted view of the log. The structured presentation with clearly labeled fields and their corresponding values is characteristic of a formatted log view, designed for readability and analysis within FortiAnalyzer.
✅ Option B: This is a normalized log. The presence of fields like data_parsername=FortiGate Log Parser explicitly indicates that the raw log has been processed by FortiAnalyzer. Normalization involves parsing raw log data and mapping it to a consistent schema with standardized field names, which is evident in this key-value pair structure. This allows FortiAnalyzer to consistently query and report on logs from various sources.
❌ Option C is incorrect: A raw log would typically be the original, unprocessed data as sent by the device (e.g., FortiGate), often a single string without predefined key-value pairs or the explicit parser information.
❌ Option D is incorrect: While the log originated from a FortiGate (indicated by data_sourcetype=FortiGate), the view shown is not the 'original' or 'raw' log. It has already been parsed and processed by FortiAnalyzer, as evidenced by the structured format and the data_parsername field.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.6.0/administration-guide/469490/log-receiving

The Chart Builder feature in FortiAnalyzer allows users to create custom visualizations. Its primary purpose is to define a specific dataset from filtered log search results and then build a corresponding chart. This process involves selecting log types, applying filters, and choosing chart parameters to graphically represent the desired data. These custom charts can then be saved and utilized in various FortiAnalyzer modules, such as FortiView dashboards or custom reports. Option D directly describes this core functionality of defining a dataset from filtered logs and building a chart from it.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/526715/chart-builder-overview (or similar FortiAnalyzer documentation for Chart Builder functionality)

The question asks which SOC role is responsible for configuring a task within a FortiAnalyzer playbook to run a report. This involves extending an existing automation workflow to include a new reporting function based on updated asset information.

A SOC engineer is responsible for the design, implementation, maintenance, and optimization of security tools, platforms, and automation. This includes configuring and fine-tuning SOAR playbooks (like those in FortiAnalyzer), integrating different security systems, and setting up automated reporting. Modifying or adding tasks to an existing playbook, especially one that interacts with other systems (FortiClient EMS) and generates reports, falls squarely within the responsibilities of a SOC engineer who builds and maintains the operational infrastructure.

Why the other choices are incorrect:

• A: Threat hunter: Threat hunters proactively search for threats and develop detection strategies, but they typically do not configure the underlying automation infrastructure or reporting systems.
• C: Security analyst: Security analysts primarily monitor alerts, investigate incidents, and use the tools and reports provided. While they might identify the *need* for such a report, they are not typically responsible for the engineering task of configuring the playbook itself.
• D: Incident responder: Incident responders manage and mitigate active security incidents. They utilize existing playbooks and tools during incident response but are not generally involved in the development or significant modification of the SOAR platform's configuration or reporting mechanisms.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/526786/playbook

✅ Option D (Correct)Reasoning: SQL SELECT queries are fundamentally used for retrieving data and information from a database. This includes querying system tables or information schema views to display database schema details such as table names, column types, and constraints. SELECT is a Data Query Language (DQL) command.
❌ Why the other choices are incorrect:

• Option A is incorrect: 'ALTER TABLE' statements are used to modify the structure of a table, not 'SELECT' queries. This is a Data Definition Language (DDL) operation.
• Option B is incorrect: 'PURGE' (often implemented with 'DELETE' or specific vendor commands) is used to remove log entries from a database. 'SELECT' retrieves data, it does not delete it. This is a Data Manipulation Language (DML) operation.
• Option C is incorrect: 'INSERT INTO' statements are used to add new rows (data) into an existing table, not 'SELECT' queries. This is a Data Manipulation Language (DML) operation.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/526786/sql-query

At the data point 21:20, the exhibit shows that:

The indexing rate temporarily exceeds the log receive rate.

This indicates FortiAnalyzer is catching up on previously received logs, processing them faster than new logs are arriving.

This is normal behavior when the system has a backlog and is working to reduce it.

Archive logs on FortiAnalyzer refer to logs that have been moved from the active log database to a compressed storage format on disk for long-term retention. To optimize disk space, these logs are compressed and saved as files, commonly utilizing the .gz extension. This process is distinct from the active, indexed logs used for real-time analysis and reporting, which reside in the database.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/464817/managing-device-logs

When moving or importing reports between ADOMs in FortiAnalyzer, two key statements are true:

• A: All charts and datasets associated with the report will be imported together. A report relies on its underlying charts and datasets to function correctly. FortiAnalyzer's export/import mechanism ensures these dependencies are bundled to maintain the report's integrity and functionality.
• C: The ADOMs must be compatible types. Reports are designed to query specific types of logs and data. For a report to be useful and accurate in a different ADOM, the source and destination ADOMs must handle compatible device logs and data structures. For example, a report designed for FortiGate logs would not function properly in an ADOM configured for FortiClient logs.

Option B is incorrect because while FortiAnalyzer handles naming conflicts, it typically appends a number (e.g., '_1') rather than the date and time. Option D is incorrect because reports can be directly exported and imported; converting them into templates first is not a prerequisite.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/462439/reports-and-templates (This general concept applies across FortiAnalyzer 7.x versions, including 7.6, regarding report import/export and ADOM compatibility).

When a report in FortiAnalyzer does not display expected information despite the logs being present, the most common culprits are the report's time frame and the underlying data queries (datasets).

• A: Test the dataset: Reports rely on datasets to retrieve specific log data. If the dataset's query is incorrect, too restrictive, or not targeting the right log fields, the information will not be pulled into the report. Testing the dataset allows verification of its output.
• B: Check the time frame covered by the report: This is a fundamental step. If the report's configured time range does not overlap with the time range of the logs, the report will naturally appear empty or incomplete for the data you are expecting.

C: Increase the report utilization quota: This relates to system resource allocation for running reports and would typically manifest as reports failing to run or taking excessive time, not as missing data within an already generated report.

D: Enable auto-cache: Auto-cache is a performance feature that speeds up report generation by caching dataset query results. It does not correct issues with data being missing due to incorrect queries or time frames.

Reference: https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/469049/reports