Incorporating endpoint device data in the web filter UTM logs

Endpoint device data, including hostname and MAC address, have been incorporated in the web filter UTM logs. Endpoint device data can be incorporated in the logs using the following:

config log setting
    set extended-utm-log {enable | disable}
end

To incorporate endpoint device data in the web filter UTM logs, ensure a firewall policy with a web filter profile is configured and Device detection is configured on the interfaces. Device detection can be configured in Network > Interfaces and the CLI.

When this command is enabled, the srcmac and srcname fields are included in the web filter UTM logs:

1: date=2024-04-04 time=09:34:31 eventtime=1712248470720798942 tz="-0700" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vdom1" policyid=1 poluuid="9f550138-ed67-51ee-b593-e4c9c3cd549f" policytype="policy" sessionid=20910 srcip=10.1.100.123 srcport=59705 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="04df25b6-ed67-51ee-3006-8c2d12813f90" srcmac="00:0c:29:06:7e:5b" srcname="AVPC3" dstip=52.201.199.27 dstport=443 dstcountry="United States" dstintf="port1" dstintfrole="undefined" dstuuid="04df25b6-ed67-51ee-3006-8c2d12813f90" proto=6 httpmethod="GET" service="HTTPS" hostname="www.httpbin.org" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH" profile="webfilter" action="blocked" reqtype="referral" url="https://www.httpbin.org/favicon.ico" referralurl="https://www.httpbin.org/" sentbyte=2088 rcvdbyte=5709 direction="outgoing" msg="URL belongs to a denied category in policy" ratemethod="domain" cat=52 catdesc="Information Technology"

Likewise, the Device column is populated with the endpoint hostname information in the Log & Report > Security Events > Logs table:

When this command is disabled, the new fields are excluded from the web filter UTM logs and the Device column does not display the client hostname information. The command is disabled by default.