how find out what URL is blocked by malicious URL filter

Forum|Forum|5 years ago
December 23, 2020
2 replies
4894 views

hello guys

i find out that 60% of firewall blocking traffic belongs to IPS rule malicious-URL. i forftigate monitoring section i could not find which user request with malicious URL are blocked. i configure a syslog server (Splunk) to gather firewall log, but still could not find the URL that caused IPS take an action to user request.

is any syslog configuration that could send User URL to syslog server ?

thanks

syslog

soheil_amiriAuthor

New Member

i find this log :

================================

Dec 23 16:13:27 x.x.x.x date=2020-12-23 time=16:13:27 devname="firewall name" devid="device serial number" logid="0421016399" type="utm" subtype="ips" eventtype="malicious-url" level="warning" vd="root" eventtime=1608727407198182657 tz="+0400" severity="high" srcip=x.x.x.1 srccountry="United States" dstip=x.x.x.2 srcintf="x1" srcintfrole="undefined" dstintf="port10" dstintfrole="undefined" sessionid=2922802009 action="dropped" proto=6 service="HTTPS" policyid=42 srcport=59736 dstport=443 attack="malicious-url" direction="outgoing" msg="URL blocked by malicious-url-list" profile="g-default" crscore=30 craction=8192 crlevel="high"

==============================

unfortunately there is no URL here !!!!!

FrankyQ

New Member

+1 Any update? No URL info in logs

Sign up

Login with SSO

Login to the community

Login with SSO