When an incident is closed as a false positive in FortiAnalyzer, it is not deleted or renumbered.
Instead, the closure action is recorded in the audit history, preserving a traceable record of analyst actions for accountability and compliance.

Checking logs directly in Log Browse helps verify if the event logs exist and are correctly ingested.
Reviewing the ADOM data policy ensures that the logs are permitted and visible within the current ADOM context, which can affect log visibility in FortiView.

Check the time frame covered by the report: If the report's time range does not match the period of the available logs, the expected information will not appear.
Test the dataset: Testing the dataset ensures that the query used to extract log information is correct and retrieving the intended data for the report.

In order to configure IOC, you require the following:
* A one-year subscription to IOC. Note that FortiAnalyzer does include an evaluation license, but it is restrictive and only meant to give you an idea of how the feature works.
* A web filter services subscription on FortiGate device(s)
* Web filter policies on FortiGate device(s) that send traffic to FortiAnalyzer