Technical Tip: How to include IPS option in the log type for FortiProxy

[Nur]

Description	This article describes how to use the Event Handler for FortiProxy to change the 'log type' value in FortiAnalyzer.
Scope	FortiProxy and FortiAnalyzer.
Solution	By default when it is necessary to create an Event Handler for FortiProxy to trigger the IPS event log, there is no option available from GUI. Hence, it is necessary to edit it from the JSON file. Go to the Event handler created -> Select export (in the text file). Open the JSON file and search under Rule -> 'logtype' -> Change to 'IPS'. After changing the 'log type' value, save it and import it again to FortiAnalyzer. When importing the file, ensure to choose 'rename' and select ok. Go to the files renamed, change the 'Group by' value to IPS and logs match as IPS. Test send dummy log from FortiProxy to FortiAnalyzer (diag log test). After sending the dummy log to FortiAnalyzer, check the event handler trigger at the event monitor, and select 'All events'.