FCP FortiAnalyzer 7.4 flashcards
FCP FortiAnalyzer 7.4 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- ADOM
- An administrative domain that partitions devices, logs, and reports so multiple tenants or business units can be managed separately on one FortiAnalyzer; a device belongs to only one ADOM.
- HA distributed mode
- A FortiAnalyzer HA mode where collector units receive logs and analyzer units run reports and queries; used when log volume exceeds what a single unit can index.
- HA standalone mode
- A FortiAnalyzer HA mode with a primary and secondary unit sharing the same configuration and log data; the secondary takes over if the primary fails.
- Firmware upgrade order in HA
- Upgrade the secondary unit first, force a failover so it becomes primary, then upgrade the former primary; this keeps log collection running during the upgrade.
- Authorizing a FortiGate
- After a FortiGate is pointed at FortiAnalyzer, the administrator must approve the device serial number on the analyzer before logs are accepted and indexed.
- NTP requirement
- FortiAnalyzer and all managed devices must synchronize to the same time source; clock skew misorders logs and breaks correlation and report time windows.
- Admin profile scope
- A profile granting read-write, read-only, or none access per feature area and per ADOM; it determines which logs and reports an administrator can see.
- Disk quota per ADOM
- A storage limit assigned to one ADOM so it cannot consume the whole log volume; on reaching the limit, that ADOM's oldest logs roll over.
- OFTP port 514
- The default protocol and TCP port FortiGate uses to send logs to FortiAnalyzer; reliable mode buffers and acknowledges logs to avoid loss.
- Reliable log transmission
- A mode where the sending device buffers logs and waits for acknowledgment from FortiAnalyzer, resending if no ack arrives, preventing loss during outages.
- Log types
- FortiGate categories of log records: traffic, event, security (UTM), anomaly, and VoIP; each can be enabled independently in the device logging configuration.
- Raw log vs indexed log
- Raw logs are stored compressed on disk for retention; indexed fields are written to the SQL database and are what Log View and reports query.
- Log forwarding
- A FortiAnalyzer rule that sends selected logs from an ADOM to another analyzer or syslog server, optionally filtered by severity or text match.
- Log archiving
- Moving aged logs to an external FTP, SFTP, or SCP server to free local disk; archived logs are not searchable until restored to the analyzer.
- Log retention policy
- Rules defining how long logs are kept before automatic deletion, triggered by age or by maximum disk usage, whichever threshold is reached first.
- diagnose log test
- A FortiAnalyzer CLI command that injects a synthetic log entry to confirm ingestion, parsing, and indexing are working on the unit.
- Report layout
- A reusable report definition composed of datasets, charts, and tables; it controls what data appears in a generated report but not when it runs.
- Dataset
- A SQL query against the FortiAnalyzer log database; its output columns supply the data for the charts and tables placed in a report layout.
- Scheduled report
- A report bound to a frequency and delivery method, such as daily email or weekly upload; the schedule also sets the log period the report covers.
- Report period mismatch
- A common misconfiguration where a scheduled report's query period does not cover the intended log window, producing empty or partial results.
- Report export and import
- The supported way to move a report layout between FortiAnalyzer instances; the layout is saved as a file and imported on the target unit.
- Chart type selection
- The chart type must match dataset output: a pie chart needs a label and a value column, while a table can display arbitrary columns.
- Failed scheduled report
- Usually caused by a dataset SQL error, missing logs for the period, or an unreachable mail or file server; last-run status shows the failure.
- Event handler
- A rule that evaluates incoming logs against conditions and triggers actions such as email, SNMP trap, syslog forward, or a playbook run.
- Frequency-based handler
- An event handler that fires only when a threshold number of matching logs occur within a defined time window, reducing noise from single events.
- Incident
- A container grouping related events and alerts for investigation; it has a status such as new, in progress, or resolved and can be created manually or automatically.
- Playbook
- An automated response sequence bound to a trigger; steps can run CLI commands, quarantine a device, or notify staff, and each run is logged.
- Automation stitch
- A connector defining an external system and stored credentials that a playbook step uses to perform actions outside FortiAnalyzer.
- Log View field search
- Search syntax using field:value pairs, wildcards, and logical operators; indexed field searches are faster than free-text searches across raw logs.
- FortiView dashboard
- An aggregated view of traffic, threats, and top sources built from indexed logs, so it reflects only logs already parsed and stored on the analyzer.
- Audit log
- A record of administrator actions such as logins, configuration changes, and report runs; separate from device logs and used for change tracking.
- Threat detection indicators
- Indicators of compromise and anomaly rules that flag suspicious behavior in collected logs; matches appear as events and can feed incident creation.