Technical Tip: FortiGate missing significant number of signatures

Description

This article describes the reasons why the FortiGate is missing a large amount of signatures.

Scope

FortiGate v7.0, v7.6

Solution

In some instances, upon review of the application signature platform, whether that is in profile or proxy mode, FortiGate might display a smaller number of signatures. The following image has the view of a FortiGate missing these (in profile mode)

This can be seen in profile mode in Security Profiles -> Application signatures and also on proxy mode in Policy & Objects -> Applications.

The image displays 2,414 signatures defined at the time of writing this article (OCT 2024). The full count of applications is rather larger. 

The following image will show the full count:

Reasons why this might happen:

1. Licensing:  The license required for a complete view is 'Attack Surface Security Rating'.

The following image has a snapshot to compare the view of the licensing of the two FortiGates under System -> FortiGuard:

2. Configuration: As described in the document  Technical Tip: IoT and OT Detection definition show version 0.000,  the configuration of the FortiGate needs to have at least one policy with application control configured.