Skip to main content
smkml
Staff
smkml
Staff
June 23, 2026

Technical Tip: Output variance between self-harm and risk indicators report and safeguarding report

  • June 23, 2026
  • 0 replies
  • 18 views

Description

 

This article describes the difference of output between Self-Harm and Risk Indicators Report and Safeguarding Report, especially in a Risky Term.

de3c528d.png


85eeb620.png


Scope

FortiAnalyzer.

Solution

Identify on each default report which dataset value is being used to generate the output.

For Self-Harm and Risk Indicators Report, the dataset used in the report is self-harm-Chat-Search-And-Message-Logging-By-Platform:


/*sql_normalized*/
select
  count(distinct user_src) as num_user
from
  ###(
    select
      $flex_timestamp as timestamp,
      filename,
      app,
      coalesce(
        nullifna(`user`),
        nullifna(`unauthuser`),
        ipstr(`srcip`)
      ) as user_src,
      `group`,
      `srcip`,
      count(*) as total_num
   .......
..........


The Self-Harm and Risk Indicators Report (filename): This dataset isolates data at the filename level. The underlying logic scans raw event streams for specific application signatures (such as search phrases and social media posts) to track file-related interactions. All associated users, IP addresses, and applications are collapsed and concatenated into a single row per file. This captures a comprehensive audit trail of file movement, regardless of the severity score.

For a Safeguarding Report, the dataset used in the report is safeguard-Top-Risk-User-by-Count:

/*sql_normalized*/
select
  f_user,
  sum(cnt) as user_num
from
  (
   ......
.........
.........
    group by
      f_user
  ) t
where
  weight > 0.8
group by
  f_user
order by
  user_num desc


The Safeguarding Report (f_user): This report ignores individual file names entirely and groups everything by the specific user (f_user). It acts as a high-level risk tracker that combines user data with device information. Crucially, the system uses a strict filter that completely throws out any user whose calculated risk score is 80% (0.8) or lower. Only users who cross this high-risk threshold will show up in this report.

Related articles:

    Terms & ConditionsAccessibility statement