FortiData is a system used to scan configured various file storages, AWS S3, SharePoint, Samba (SMB), and Google Drive. FortiData uses AI/ML and various classifiers and frameworks to classify and label files to determine their sensitivity for various use cases such as public exposure, third-party access, data encryption, and data minimization. This can also be used to assess risk.
This new feature allows FortiOS to query FortiData for built-in or custom labels for use in DLP security profiles. When configured in a DLP profile, FortiOS queries FortiData with file hashes to verify if the scanned file matches a file scanned and labelled by FortiData. If the file matches a take the configured action in the DLP profile.
For information on connecting FortiGate and FortiData, see Connecting FortiData to FortiGate.
For information on configuring FortiData labels in a DLP profile, see FortiData labels.
When FortiOS is unable to query the FortiData an error occurs. The default of this action 'block' and the option is configurable.
Raw log example of the FortiData error:
date=2026-05-12 time=09:42:34 eventtime=1778604154752611641 tz="-0700" logid="0956024581" type="utm" subtype="dlp" eventtype="dlp-error" level="warning" vd="root" error="fortidata" dlpextra="internal_error" policyid=2 poluuid="90a428e2-4802-51f1-cc8d-6097fefe15f6" policytype="policy" sessionid=120317 epoch=0 eventid=0 srcip=10.119.0.2 srcport=50045 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="2a9b55c6-47f7-51f1-f4da-28467a7aec5e" dstip=206.47.132.132 dstport=443 dstcountry="Canada" dstintf="port1" dstintfrole="undefined" dstuuid="2a9b55c6-47f7-51f1-f4da-28467a7aec5e" proto=6 service="HTTPS" filetype="python" direction="outgoing" action="block" hostname="dlptest.ai" url="https://dlptest.ai/api/upload-file" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" httpmethod="POST" referralurl="https://dlptest.ai/" filename="helloworld.py" filesize=785 profile="fortidata-dlp"
The error action can only be configured in the CLI on the DLP profile. There are three possible actions:
config dlp profile
edit "fortidata-dlp"
set fortidata-error-action {log-only | block | ignore}
next
end
For FortiOS to query FortiData for its built-in and custom labels, the FortiData system settings need to be enabled on the CLI.
config system fortidata
set status enable
end
FortiData must be configured to accept label queries from FortiOS. For FortiData to accept label queries from FortiOS, the 'Label Query Service' must be enabled and the querying device (FortiGate) must be added.
Integration -> Label Query.
Select the 'Add Device' button to configure the name, device type, and IP address of the connecting FortiGate.
 Related articles: | 
