Technical Tip: IPS profile actions and corresponding actions in logs

[FrankY1]

Description	This article explains the action configured in the IPS profile and the expected value in the 'action' section in IPS logs.
Scope	FortiGate.
Solution	When an IPS signature is triggered, the logs may show values in the 'Action' section different from the action set in the signature. Refer to the following table for detailed correspondence: Action in Profile Action Meaning Action in Logs default The default action set by IPS(can be any of the actions below). allow Allow the traffic without logging it. monitor Allow the traffic and log it. detected block Drop the traffic silently. dropped reset Send TCP reset to the source. reset quarantine Drop future packets for the next x minutes. dropped References: Configuring an IPS sensor Technical Tip: IPS default action selection criteria