Fortigate IPS threat logs lack sufficient info for investigation

[markmcgloin]

All our traffic goes via a load balancer and ssl traffic is terminated there. All attack logs for IPS signatures show the IP address of that load balancer and do not show any details of the url which is what the load balancer uses to route traffic.

Is there a way to configure fortigate so we can view this additional http info so we can determine the real destination for attacks?

[dfroe]

As far as I know the IPS engine kicks in quite early. I.e. before any webfilter for instance. So even combining the IPS profile with a log-only webfilter profile does not help as the webfilter profile won't be able to log that connection because it is already dropped by the IPS engine. And the IPS engine on the other hand lacks logging of protocol-specific information like HTTP hostname or URL.

Maybe you can workaround by capturing packets of IPS attacks and later manually investigate them by using Wireshark.

Would be interesting to see whether somebody has a real solution for this issue.