Archive logs on FortiAnalyzer are logs that have been stored in files and, once a log file reaches its size limit, it is “rolled” and compressed, becoming offline logs. These compressed archive logs are saved as files, typically with the .gz extension, and are not immediately viewable or reportable in FortiView, Log View, or Reports panes.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/761825/analytics-and- archive-logs

The topology shows a Security Fabric setup involving FortiGate devices (FGT-A and FGT-B) and a FortiAnalyzer for centralized logging. Let’s break down the logging and traffic flow behavior:
Traffic Flow Analysis:
Client-1 initiates web traffic directed to the internet, which is routed through FGT-B and then FGT- A before reaching the internet. This is indicated by the direction of the red-dashed arrow from Client-1 through FGT-B to FGT-A.
Policy and NAT Settings:
On FGT-B, NAT is disabled, meaning it will pass the traffic through without altering the source IP.
This device has a Web Filter enabled with a policy to log violations only. On FGT-A, NAT is enabled, and a Web Filter profile is also applied. Like FGT-B, it logs only violations for web filtering.
Logging Behavior:
Since both FortiGate devices have logging enabled for traffic and web filtering, they can create logs if conditions are met.
FGT-B will log all traffic, as per its configuration, and will also create web filter logs if it detects a violation, as the web filter profile is applied. Because NAT is disabled on FGT-B, it processes the traffic but doesn’t perform any address translation, allowing it to see the original source IP of Client-1. FGT-A, as the Security Fabric root, will handle NAT and forward the traffic to the internet. However, in this case, the question is focused on where the traffic and web filter logs would be generated first, particularly by FGT-B.

Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
The exhibit shows the log as a single-line key/value entry (not a columnar/table display), which aligns with FortiAnalyzer’s raw log format view option. The study guide states: “You can toggle between viewing formatted and raw logs.” This directly supports observation D.
At the same time, what you are viewing in FortiAnalyzer Log View is normalized data (FortiAnalyzer parses and maps device logs into standardized fields for consistent searching and analysis). The study guide explicitly states: “The log view allows you to view all log types received by FortiAnalyzer in normalized log format.” It also explains that FortiAnalyzer “uses predefined parsers to extract key fields from ingested logs and maps them to a consistent, standardized set of field names,” then stores them as normalized logs in the SIEM database. This supports observation A.
Finally, the study guide clarifies that even when you switch to raw log format in FortiAnalyzer, you are still observing the normalized-field representation produced by FortiAnalyzer’s parser/normalization process (rather than the untouched original device message). It notes that a FortiGate event log “has been normalized by FortiAnalyzer,” and when you switch “to raw log format,” you can observe the effect of normalization on common fields. This is why C is not the best description for the exhibit.

Send Alert through Fabric Connectors: This method involves creating a Fabric Connector profile and selecting the option “Send Alert through Fabric Connectors” in the event handler notification settings. Notifications are then sent in JSON format to the configured endpoint, such as Microsoft Teams or other integrated platforms.
Send SNMP trap: You can configure SNMP traps to be sent when an event triggers an incident.
This involves setting the SNMP Trap IP address, community string, trap type, and protocol in the system’s analytics or incident settings.

In FortiAnalyzer’s SQL query syntax, the typical order for querying the database follows the standard SQL format, which is:
SELECT <column(s)> FROM <table> WHERE <condition(s)> GROUP BY <column(s)>
* Option D correctly follows this structure:
* SELECT devid FROM $log: This specifies that the query is selecting the devid column from the $log table.
* WHERE ‘user’ = ‘: This part of the query is intended to filter results based on a condition involving the user column. Although there appears to be a minor typographical issue (possibly missing the user value after =), it structurally adheres to the correct SQL order.
* GROUP BY devid: This groups the results by devid, which is correctly positioned at the end of the query.
Let’s briefly examine why the other options are incorrect:
* Option A: SELECT devid FROM $log GROUP BY devid WHERE ‘user’, ‘users1’
* This is incorrect because the GROUP BY clause appears before the WHERE clause, which is out of order in SQL syntax.
* Option B: SELECT FROM $log WHERE devid ‘user’, USER1′ GROUP BY devid
* This is incorrect because it lacks a column in the SELECT statement and the WHERE clause syntax is malformed.
* Option C: SELCT devid WHERE ‘user’ – ‘USER1’ FROM $log GROUP BY devid
* This is incorrect because the SELECT keyword is misspelled as SELCT, and the WHERE condition syntax is invalid.
* FortiAnalyzer documentation for SQL queries indicates that the standard SQL order should be followed when querying logs in FortiAnalyzer. Queries should follow the format SELECT … FROM … WHERE …
GROUP BY …, as demonstrated in option D.

When a new playbook is created on FortiAnalyzer, the system requires some time to parse and validate the playbook before it can be executed. Parsing involves checking the playbook’s structure, ensuring that all syntax and logic are correct, and preparing the playbook for execution within FortiAnalyzer’s automation engine. This initial parsing step is necessary for FortiAnalyzer to load the playbook into its operational environment correctly.
Here’s why the other options are incorrect:
* Option A: FortiAnalyzer needs that time to parse the new playbook
* This is correct. The delay is due to the parsing and setup process required to prepare the new playbook for execution. FortiAnalyzer’s automation engine checks for any issues or dependencies within the playbook, ensuring that it can run without errors.
* Option B: FortiAnalyzer needs that time to debug the new playbook
* This is incorrect. Debugging is not an automatic process that FortiAnalyzer undertakes after playbook creation. Debugging, if necessary, is a manual task performed by the administrator if there are issues with the playbook execution.
* Option C: FortiAnalyzer needs that time to back up the current playbooks
* This is incorrect. FortiAnalyzer does not automatically back up playbooks every time a new one is created. Backups of configuration and playbooks are typically scheduled as part of routine maintenance and are not triggered by playbook creation.
* Option D: FortiAnalyzer needs that time to ensure there are no other playbooks running
* This is incorrect. FortiAnalyzer can manage multiple playbooks running simultaneously, so it does not require waiting for other playbooks to finish before initiating a new one. The waiting time specifically relates to the parsing process of the newly created playbook.
* FortiAnalyzer documentation states that after creating a playbook, a brief delay is expected as the system parses and validates the playbook. This ensures that any syntax errors or logical inconsistencies are resolved before the playbook is executed, making option A the correct answer.

In FortiOS and FortiAnalyzer logging systems, when an event has a status of “Mitigated” in the Event Status column, it typically indicates that the system took action to address the identified threat. In this case, the Web Filter blocked the web request to a suspicious destination, and the event status “Mitigated” confirms that the action was successfully implemented to neutralize or block the security risk.

Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
FortiAnalyzer 7.6 stores on-premises logs in a ClickHouse SQL database (not MySQL, Postgres, or Elasticsearch). Fortinet’s FortiAnalyzer 7.6 SQL Query documentation explicitly states that log data is inserted into the SQL database and that “FortiAnalyzer uses a ClickHouse SQL database.” This is consistent with how the study guide describes the storage/analytics pipeline in 7.6: it explains that FortiAnalyzer indexes incoming raw logs (insert rate) “by the SQL database and the sqlplugind daemon.” This “SQL database” in 7.6 corresponds to the ClickHouse-backed log database described in the Fortinet documentation.

Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
FortiAnalyzer’s ingestion pipeline does not “drop” logs simply because a parser is unavailable. The study guide states that when devices send logs, “Logs received are decompressed and saved in a log file on the FortiAnalyzer disk” (with a .log extension). This establishes that the raw log is still accepted and stored on disk as part of the normal workflow.
Normalization, however, depends on having a suitable parser. The study guide explains that “FortiAnalyzer uses predefined parsers to extract key fields from ingested logs and maps them to a consistent, standardized set of field names.” It further emphasizes that “Log parsers … are central to log normalization” because they convert unstructured/native logs into a standardized schema.
Therefore, if no matching parser exists for a given device log, FortiAnalyzer can still store the incoming log (it is received, decompressed, and written to disk), but it cannot perform the “extract key fields” and “map to standardized field names” steps required for normalization. In practical terms, the log remains in its native
/unstructured form (not normalized), which aligns exactly with option C.

When you frequently use the same search parameters in FortiAnalyzer’s Log View, setting up a reusable filter or view can save considerable time.
Option B – Configure a Custom View:
Custom views in FortiAnalyzer allow analysts to save specific search filters and configurations. By setting up a custom view, you can retain your frequently used search parameters and quickly access them without needing to reapply filters each time. This option is specifically designed to streamline the process of recurring log searches.

Macros on FortiAnalyzer are predefined or custom query templates used in reports, and they are organized by ADOM (Administrative Domain). When using ADOMs, you must be in the correct ADOM to create or manage macros, indicating that macros are ADOM-specific and tailored to the device types or datasets relevant to that ADOM.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/617380/creating- macros

To run the FortiSIEM Collector management extension application, the following requirements must be met:
FortiAnalyzer 7.0.1 or above
FortiSIEM Supervisor, Worker, Collectors 6.3.0 or above.
FortiSIEM Linux Agent 6.3.0 or above.
FortiSIEM Windows Agent 4.1.2 or above.