Changing an incident's status to Closed: Remediated means the incident has been resolved and no longer requires active attention. This action inherently impacts the incident dashboard, which tracks key metrics like active incidents, mean time to resolution, and incident status distribution.
The dashboard dynamically updates to reflect the current state of all incidents, including those newly closed.

In a FortiAnalyzer Fabric deployment, the supervisor can analyze logs, indicators, and events from Fabric members. Reports and playbooks remain ADOM-specific and are not automatically aggregated across the Fabric for analysis.

The commands shown are:
diagnose fortilogd lograte → shows the log receiving/indexing rate
diagnose fortilogd msgrate → shows the message processing rate
In the output, both rates are very low over the last 5, 30, and 60 seconds. This indicates that FortiAnalyzer is almost finished processing (indexing) incoming logs and messages, with no significant backlog.

Macros on FortiAnalyzer are predefined or custom query templates used in reports, and they are organized by ADOM (Administrative Domain). When using ADOMs, you must be in the correct ADOM to create or manage macros, indicating that macros are ADOM-specific and tailored to the device types or datasets relevant to that ADOM.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/617380/creating- macros