Extended Logs in FortiOS 6.0 Protection profiles

From version 6.0 of FortiOS, permissions must be granted with commands to enable "Extended Logs" in IPS, Antivirus, Webfilter, Application Control, and DLP protection profiles.

This means more domains, more traffic details, and the HTTP method used, UserAgent, Type, etc. It allows us to see requests.

It can be activated in Flow Mode, profiles such as Application Control, IPS, Antivirus, Webfilter, DLP.

To enable Extended Logs, we must make the necessary definitions with the CLI in each security profile we want to enable.

Here you can see all the examples to activate in each of the profiles and sensors.

Application Control

config application list

edit "nombre_perfil"

set extended-log enable

end

IPS

config ips sensor

edit " nombre_sensor "

set extended-log enable

end

Antivirus

config antivirus profile

edit " nombre_perfil"

set extended-log enable

end

Webfilter

config webfilter profile

edit " nombre_perfil"

set inspection-mode flow-based

set inspection-mode flow-based

set extended-log enable

end

DLP

config dlp sensor

edit "nombre_sensor"

set flow-based enable

set extended-log enabled

end