Technical Tip: How to enable 'httpmethod' and 'referrer url' parameters in the HTTP transaction logs for FortiAnalyzer or syslog or FortiSIEM

[jhussain_FTNT]

Description	This article describes how to enable 'httpmethod' and 'referrer url' parameters in the HTTP transaction logs for FortiAnalyzer or syslog or FortiSIEM
Scope	ForitProxy.
Solution	The default HTTP transaction logs in Fortiproxy do not include information regarding the 'http method' and 'referrer URL' parameters. To include 'http method' and 'referralurl' parameters in Fortiproxy logs, configure the Firewall policy to set log-http-transaction to all and enable extended-log: config firewall policy     edit <policy id>         set logtraffic all         set logtraffic-start enable         set log-http-transaction all         set extended-log enable     next end After enabling the settings, the 'http method' and 'referralurl' parameter information are in the logs. FortiProxy: date=2024-08-12 time=13:12:47 eventtime=1723457567180725453 tz="+0300" logid="0010000099" type="traffic" subtype="http-transaction" level="notice" vd="root" srcip=10.212.3.1 dstip=147.182.197.70 clientip=10.212.3.1 scheme="http" srcport=64088 dstport=80 hostname="www.nekocloud.com" url="http://www.nekocloud.com/vendor/jquery-easing/jquery.easing.min.js" prefetch=0 policyid=23 sessionid=1231606552 transid=67108915 reqlength=360 resplength=1160 rcvdbyte=1160 sentbyte=360 resptype="normal" referralurl="http://www.nekocloud.com/" httpmethod="GET" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0" statuscode="200" rawdata="Time=336ms|Header-Host=www.nekocloud.com|Response-Content-Type=text/javascript" reqtime=1723457566 resptime=1723457567 respfinishtime=1723457567 duration=335 appcat="unscanned" FortiAnalyzer: logver=0704040603 idseq=229240816239902721 itime=1723453889 devid="FPX2KET318000006" devname="MRJ-FortiProxy-SEC-02" vd="root" date=2024-08-12 time=13:12:47 eventtime=1723457567180725453 tz="+0300" logid="0010000099" type="traffic" subtype="http-transaction" level="notice" srcip=10.212.3.1 dstip=147.182.197.70 clientip=10.212.3.1 scheme="http" srcport=64088 dstport=80 hostname="www.nekocloud.com" url="http://www.nekocloud.com/vendor/jquery-easing/jquery.easing.min.js" prefetch=0 policyid=23 sessionid=1231606552 transid=67108915 reqlength=360 resplength=1160 rcvdbyte=1160 sentbyte=360 resptype="normal" referralurl="http://www.nekocloud.com/" httpmethod="GET" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0" statuscode="200" rawdata="Time=336ms|Header-Host=www.nekocloud.com|Response-Content-Type=text/javascript" reqtime=1723457566 resptime=1723457567 respfinishtime=1723457567 duration=335 appcat="unscanned"