Example: How the FortiGate unit records a DLP event

Chapter 13 Logging and Reporting : Logging and reporting overview : What is logging? : How the FortiGate unit records log messages : Example: How the FortiGate unit records a DLP event

1. The FortiGate unit receives incoming traffic and scans for any matches associated within its firewall policies containing a DLP sensor.

2. A match is found; the DLP sensor, dlp_sensor, had a rule within it called All-HTTP with the action Exempt applied to the rule. The sensor also has Enable Logging selected, which indicates to the FortiGate unit that the activity should be recorded and placed in the DLP log file.

3. The FortiGate unit exempts the match, and places the recorded activity (the log message) within the DLP log file.

4. According to the log settings that were configured, logs are stored on the FortiGate unit’s local hard drive. The FortiGate unit places the DLP log file on the local hard drive.