Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
soheil_amiri
New Contributor

how find out what URL is blocked by malicious URL filter

hello guys

i find out that 60% of firewall blocking traffic belongs to IPS rule malicious-URL. i forftigate monitoring section i could not find which user request with malicious URL are blocked. i configure a syslog server (Splunk) to gather firewall log, but still could not find the URL that caused IPS take an action to user request.

is any syslog configuration that could send User URL to syslog server ?

thanks

2 REPLIES 2
soheil_amiri
New Contributor

i find this log : 

================================

Dec 23 16:13:27 x.x.x.x date=2020-12-23 time=16:13:27 devname="firewall name" devid="device serial number" logid="0421016399" type="utm" subtype="ips" eventtype="malicious-url" level="warning" vd="root" eventtime=1608727407198182657 tz="+0400" severity="high" srcip=x.x.x.1 srccountry="United States" dstip=x.x.x.2 srcintf="x1" srcintfrole="undefined" dstintf="port10" dstintfrole="undefined" sessionid=2922802009 action="dropped" proto=6 service="HTTPS" policyid=42 srcport=59736 dstport=443 attack="malicious-url" direction="outgoing" msg="URL blocked by malicious-url-list" profile="g-default" crscore=30 craction=8192 crlevel="high"

==============================

unfortunately there is no URL here !!!!!

FrankyQ

+1 Any update? No URL info in logs

Labels
Top Kudoed Authors