The commands diagnose fortilogd lograte and diagnose fortilogd msgrate shown are global FortiAnalyzer diagnostic commands that provide log and message rates without reference to any specific ADOM (Administrative Domain). Therefore, the output is not ADOM specific.

Once an event is escalated to an incident, it requires investigation, containment, eradication, and recovery actions. These activities fall under the responsibilities of the incident responder, who handles confirmed security incidents and coordinates remediation efforts.

The main clauses FortiAnalyzer reports use are as follows:
* FROM
* WHERE
* GROUP BY
* ORDER BY
* LIMIT
* OFFSET
Accordingly, following the SELECT keyword, the statement must be followed by one or more clauses in the order in which they appear in the table shown on this slide.

When configuring event handlers on FortiAnalyzer, data selectors act as global filter criteria.
These filters are applied at the event handler level, allowing all rules within that handler to inherit the same conditions. This avoids the need to repeatedly configure identical filters for each individual rule.