A utility's SOC wants full session-level visibility into traffic between the corporate billing network and the field-operations network, including successful, uneventful sessions with no security profile hits, for a compliance audit trail. An engineer reviews an existing policy and finds its logging option set to log security events only. What does the engineer need to change to meet the SOC's requirement?
Select an answer to reveal the explanation.
Short Explanation
'Security events only' logs the exciting stuff, the sessions a security profile actually flagged, and skips the boring, clean ones. If the SOC wants every session, clean or not, the policy has to be told to log all sessions instead.
Full Explanation
A FortiOS firewall policy's logging option determines what gets recorded even when the session is otherwise permitted normally: 'log all sessions' writes a traffic log entry for every session the policy allows, while 'log security events only' restricts logging to sessions where an attached security profile (antivirus, IPS, web filtering, and similar) actually took an action worth recording. A compliance audit trail that needs to show routine, uneventful traffic, not just flagged traffic, requires the broader 'log all sessions' setting, because the narrower option was designed to reduce log volume by skipping exactly the sessions the SOC now wants visibility into. The claim that every permitted session already counts as a security event misunderstands the terminology; 'security event' here means a profile-triggered action, not simply that traffic passed the firewall. The implicit deny's logging setting governs visibility into denied traffic, which is a different question from wanting full visibility into traffic that is already being allowed, turning that on would not add the missing successful-session logs the SOC is asking about. And traffic logging is not gated behind having a security profile attached; a policy with no UTM profiles at all can still log all sessions if configured to. To confirm the change worked, the engineer generates a routine, clean session across this policy and checks that a traffic log entry now appears even though no security profile fired.