We deploy the FortiGate 400E as IDS to port mirror FortiGate FW.
- ips license is enable on this 400E, but without web filtering license.
To get http header raw data(request url, request method, user agent, x-forwarded-for,referer) from ips log.
Am I able to get http header data if just enable extended-log in ips profile setting ?
"set extended-log enable"
Thanks in advance.
Henry Xu
Dear Henry,
you should be able to get the HTTP headers in IPS logs just as well as webfilter logs - if you refer to https://docs.fortinet.com/document/fortigate/6.2.3/fortios-log-message-reference/630151/utm-extended-logging, you can see that extended logging is for UTM logs in general, no matter the subtype (IPS, webfilter, whatever).
Please note that the full extended UTM log is only sent to reliable syslog servers (syslog via TCP), and all other logging solutions will receive a truncated rawdata field.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
