In FortiSIEM, you can’t delete system reports directly—clone them and delete instead.

In FortiSIEM, can you delete system reports directly?

• A. Yes, always
• B. No, but you can clone and delete them
• C. Yes, but only for certain reports
• D. No, they are permanent

Answer: (B)

In FortiSIEM, while you cannot delete system reports directly, you have the option to clone and then delete those reports. This process allows for greater flexibility and management of report contents without permanently affecting the system’s data integrity. Cloning a report creates a copy that can be modified and deleted, allowing users to maintain essential system reports while still tailoring the reporting to specific needs. This feature is important for users who may want to customize the reports for specific use cases while keeping the original unaltered for reference or compliance purposes. The ability to clone and delete reports ensures that users can effectively manage their reporting needs without compromising the foundational data that FortiSIEM relies upon for its operations. This maintains a balance between customization and system integrity, which is vital for robust network security management.

If you’re juggling FortiSIEM reports, you’ve probably run into a subtle but important rule: you can’t delete system reports directly. But there’s a clean workaround that keeps you efficient without risking the integrity of your data. The short answer is this: No, you can’t delete system reports outright, but you can clone a report and then delete the clone. Let me unpack what that means and why it matters in day-to-day security operations.

Can you delete system reports directly in FortiSIEM?

The answer, plainly, is no. FortiSIEM protects the core system reports from being removed in one hit. The logic here is simple and smart: those core reports are built on the backbone of your monitoring and alerting framework. If they disappeared, you’d risk losing a stable reference point for audits and compliance. Yet FortiSIEM gives you a practical lever—clone a report, tailor that copy, and delete the copy when you’re done. It’s a thoughtful balance between customization and maintaining a trusted baseline.

What cloning buys you (and what you’ll do with the clone)

Think of cloning as making a precise copy of a report. The clone is your blank canvas: you can tweak included fields, add or remove filters, adjust the time window, or tailor the output for a specific audience or use case. Because the original stays intact, you always have a dependable reference if you need to compare new results against a known baseline.

Here’s a typical workflow you’ll actually follow:

• Locate the system report you want to work with.

• Choose the Clone option (often found in the report’s action menu).

• Give the new report a descriptive, clear name, so your team can tell at a glance what it’s for (for example, “Weekly SOC Network Health – Q3” or “Compliance Digest - FortiSIEM 30-day”).

• Make your adjustments. You might refine the data sources, tweak the filters, change the layout, or add new charts.

• Save the clone. It now behaves like a regular report that you can run, schedule, or share.

• When it’s no longer needed, you can delete the clone without touching the original report.

Why this approach makes sense in a security operations context

• Data integrity and auditability. The original system report remains a trusted reference. If a change gets messy, you don’t accidentally erase something foundational.

• Tailored views for different teams. Your SOC team might want a compact, action-oriented view, while auditors may need a longer, more detailed version. Cloning makes both possible without creating conflicting data sources.

• Compliance and governance. Keeping the baseline intact supports traceability during reviews. If a regulator or internal policy asks for historical baselines, you still have them in the original report, untouched.

A practical sense of the workflow beyond the screen

Let’s connect the dots with a quick mental model. Imagine you’re cooking with a favorite recipe. The original recipe is your tried-and-true base. You can copy it, adjust spices, or scale portions for a different crowd. Still, you don’t throw away the original recipe—that would be essentially tossing your reliable foundation. Cloning a FortiSIEM report works the same way. You create a customized version for a project or a team, and you keep the original recipe handy for reference, audits, or future comparisons.

Tips for making the most of cloning in FortiSIEM

• Name with purpose. Use clear, consistent naming that shows the report’s audience and timeframe. “OpsQ3-weekly” or “Audit-Policy-Changes” communicates intent at a glance.

• Document what changes you make. A short note in the description field helps teammates understand why this clone exists and what was customized.

• Control access. Limit who can clone or delete reports. That protects against drift in how reports are used across teams.

• Schedule and share thoughtfully. If a clone will be used by a team, consider scheduling it and sharing the output through a dashboard or a distribution list. Automation saves time and reduces human error.

• Test before you rely on it. Run the clone to confirm it captures the expected data, and adjust if necessary. A quick sanity check now prevents bigger issues later.

Common scenarios where cloning shines

• Team-specific dashboards. Your network operations center might want a concise view, while compliance wants a more expansive one. Clone and tailor, then publish each version to the right audience.

• Incident investigations. During a breach or alert investigation, you can create a temporary clone that focuses on relevant logs and metrics. Once the investigation wraps, delete the temporary clone without disturbing the baseline.

• Compliance-ready reporting. Regulatory needs can change. A cloned report can be adjusted for new requirements while the original remains as a stable reference point.

What to watch out for (so you don’t shoot yourself in the foot)

• Don’t delete the original by mistake. It’s a common pitfall when you’re juggling several reports at once. So, always confirm you’re deleting a clone.

• Keep a minimal set of clones. If you end up with a dozen variations, you’ll waste time finding the right one. Regularly prune duplicates and archive what isn’t needed.

• Be mindful of data scope. A clone is great for customization, but it can also broaden or narrow scope inadvertently. Double-check the data sources and filters after cloning.

• Align with broader governance. If your organization has a reporting governance policy, reflect it in how you name, store, and retire clones.

A few words on the bigger picture

Fortinet’s FortiSIEM sits within a larger security fabric. It talks to other Fortinet products and helps you see what’s happening across your environment in one place. The concept of cloning a report fits neatly with how you want to maintain clarity as you scale operations. You get the flexibility you need to address diverse stakeholder needs, while keeping the core, system-wide reports intact for consistency and reliability. It’s a small feature with a meaningful impact on how you manage visibility and accountability in security monitoring.

Towards easier, smarter reporting

If you’re building up your NSE 5 knowledge, you’ll notice that the reporting capabilities in FortiSIEM are part of a broader toolkit. Good reporting isn’t just about getting data; it’s about turning data into actions. By cloning and adjusting reports, you tailor insight without abandoning the security foundation you rely on every day. It’s a practical habit that helps you balance customization with stability—two essentials in effective security management.

Quick recap you can tuck away

• You cannot delete system reports directly in FortiSIEM.

• You can clone a system report and delete the clone.

• Cloning preserves the original, while giving you a customizable view for specific needs.

• Use clear naming, document changes, and manage access to keep governance tight.

• Use cloning to support different teams, investigations, and compliance activities without risking the base report.

If you’ve ever wished for a way to experiment with a report without touching the core, cloning is your friend. It’s a simple, thoughtful feature that reflects the practical mindset many security professionals bring to their work: protect what’s proven while still exploring what could help you operate smarter. And in a world where threats evolve quickly, that balance isn’t just nice to have—it’s essential.

Want to make the most of FortiSIEM reporting? Start by identifying a couple of everyday needs—a SOC view, an audit view, and a short incident-triage view. Clone a system report to match each need, then compare results over a couple of weeks. You’ll likely find the process not only straightforward but also surprisingly empowering. After all, when you can tailor insight without compromising the backbone, you’ve got a reliable edge in your security journey.