Syslog for Banned / Quarantined IP

Support Forum

The Forums are a place to find answers on a range of Fortinet products from peers and product experts.

Hey all,

I have syslog configured and receiving all my data beautifully in GrayLog.

What I'm not getting, is any indicator that an IP has been added to Quarantine / Banned IP.

FortiOS 5.6.5

I.E. I received an IPS trigger today from 117.1.189.196, and all I see is the IPS event. The IP is now in banned IP tab, but I want to set up a notification/report of these IPS whenever they are quarantined. Is there a specific facility, or am I missing something?

Thanks.

FCNSP

-------------------------------------

"They have us surrounded again, those poor bastards."

-Unnamed Medic

FCNSP ------------------------------------- "They have us surrounded again, those poor bastards." -Unnamed Medic

1519

0 REPLIES 0

Top Kudoed Authors

User

Count

1737

1107

752

447

240

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Syslog for Banned / Quarantined IP

Nominate a Forum Post for Knowledge Article Creation