Retrieve hostname/user from its IP or MAC Address

Hey FortiUser5,

please note that if you have a layer3 switch in between the FortiGate and that user, the MAC address may not actually be accurate.

Depending on what device the user is on, the MAC address might also be randomly generated.

If there is no switch in between, and the device in question does NOT randomize MAC addresses, then yes you can get the detected MAC address from traffic log (there should be a matching one for the web-filter log, simply search for traffic logs with same session ID).

If there is an L3 switch in between, then you can instead check DHCP server records to find who requested that IP, and get the MAC address from there (depending on how long ago this was).

Again, this might not work if the device in question randomizes MAC addresses.

Aside from that, you can only really make changes to detect the user going forward, like enforcing some kind of authentication (FSSO might be an option if you're in a Windows AD environment and want the authentication to be passive, without user input required), so that users are logged in the future.