I85PREP
⌘ K
FCP FortiAnalyzer 7.4 study materials
FCP FortiAnalyzer 7.4 study resources

FCP FortiAnalyzer 7.4: Reports and Report Management

FCP FortiAnalyzer 7.4 · Work through your exam, one topic at a time.

All guide sections

Reports and Report Management

Reports and Report Management tests whether you can turn stored logs into repeatable, scheduled output in FortiAnalyzer 7.4. The exam expects you to know the building blocks: datasets, report templates, charts, output profiles, and schedules, and to diagnose an empty or failed report.

Building blocks

  • A dataset is a SQL query against the log database. It defines the fields, filters, and aggregation. A dataset can be reused by multiple charts and templates.
  • A report template defines layout, sections, charts, and text. Templates can be predefined or custom.
  • Charts bind a dataset to a visualization type such as table, bar, pie, or line.
  • An output profile defines format (PDF, HTML, CSV, XML), recipients, and mail server behavior.
  • A schedule runs a template with an output profile at a set time and scope.

Scope and filters

Reports run in an ADOM and a time period. Device filters, log filters, and time filters must match the data. Macros and relative time ranges let a scheduled report cover "last 7 days" without editing SQL. If a report is empty, first confirm the dataset returns rows in Log View for the same period, then check template filters and ADOM scope.

Worked example

Create a weekly "top blocked applications" report. Write a dataset that selects application name and count from traffic logs where action is denied, grouped by application, ordered descending. Create a chart from that dataset, place it in a custom template, attach an output profile that emails PDF to the security team, and schedule it for Monday 07:00 in the analyzer's time zone. Reasoning: the dataset owns the logic, the template owns presentation, the output profile owns delivery, and the schedule owns timing.

Operations

Report generation is queued. Failed reports usually point to SQL errors, missing fields, unavailable mail server, or permissions. Report permissions follow administrator profile and ADOM. Large reports can take time; schedule them outside peak log ingestion.

Traps

  • Writing SQL with the wrong log field names or wrong $log table.
  • Forgetting that a report is ADOM-scoped.
  • Scheduling in UTC when the team expects local time.
  • Using a dataset that references a log type the device does not send.
  • Blaming the scheduler when the mail server or output profile is misconfigured.