This allows FortiAnalyzer to correctly identify and process logs from different members of the HA cluster.

C . One or more remote LDAP servers: FortiAnalyzer needs to be configured to communicate with your external LDAP server where the user accounts and groups reside. This involves setting up the LDAP server address, port, and authentication details.
B . An administrator group: You need to create an administrator group on FortiAnalyzer and link it to the specific LDAP group that contains the users you want to grant administrative access. This allows any user within that LDAP group to authenticate and have the permissions assigned to the administrator group on FortiAnalyzer.
This configuration allows FortiAnalyzer to authenticate users against the external LDAP server and authorize them based on their membership in the designated LDAP group. This way, you don't need to create individual local accounts for each administrator, simplifying user management and centralizing authentication.

To prevent log modification or tampering: The set log-checksum command with options like md5 or sha1 calculates a checksum value for the log data. This checksum acts as a digital signature, allowing FortiAnalyzer to verify the integrity of the logs and detect any unauthorized modifications.
To protect log data from man-in-the-middle attacks: By using checksums, FortiAnalyzer can ensure that the logs received have not been altered in transit during a man-in-the-middle attack. If the checksum of the received logs doesn't match the expected value, it indicates potential tampering.
FortiAnalyzer_7.0_Study_Guide-Online page 149

Reference:
Using FortiAnalyzer, you can enable log fetching. This allows FortiAnalyzer to fetch the archived logs of specified devices from another FortiAnalyzer, which you can then run queries or reports on for forensic analysis.
The FortiAnalyzer device that fetches logs operates as the fetch client, and the other FortiAnalyzer device that sends logs operates as the fetch server. Log fetching can happen only between two FortiAnalyzer devices, and both of them must be running the same firmware version. A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with different FortiAnalyzer devices at the other end.
FortiAnalyzer_7.0_Study_Guide-Online pag. 168

"Enable auto-cache in the report settings to boost the reporting performance and reduce report generation time. Scheduled reports have auto-cache enabled already." FortiAnalyzer_7.0_Study_Guide-Online page 306