how find out what URL is blocked by malicious URL filter

[soheil_amiri]

hello guys

i find out that 60% of firewall blocking traffic belongs to IPS rule malicious-URL. i forftigate monitoring section i could not find which user request with malicious URL are blocked. i configure a syslog server (Splunk) to gather firewall log, but still could not find the URL that caused IPS take an action to user request.

is any syslog configuration that could send User URL to syslog server ?

thanks

[soheil_amiri]

i find this log : 

================================

Dec 23 16:13:27 x.x.x.x date=2020-12-23 time=16:13:27 devname="firewall name" devid="device serial number" logid="0421016399" type="utm" subtype="ips" eventtype="malicious-url" level="warning" vd="root" eventtime=1608727407198182657 tz="+0400" severity="high" srcip=x.x.x.1 srccountry="United States" dstip=x.x.x.2 srcintf="x1" srcintfrole="undefined" dstintf="port10" dstintfrole="undefined" sessionid=2922802009 action="dropped" proto=6 service="HTTPS" policyid=42 srcport=59736 dstport=443 attack="malicious-url" direction="outgoing" msg="URL blocked by malicious-url-list" profile="g-default" crscore=30 craction=8192 crlevel="high"

==============================

unfortunately there is no URL here !!!!!

[FrankyQ]

+1 Any update? No URL info in logs