I am trying to get the Fortigate (FG51E or FG100) to send web traffic events. I am getting the IPTraffic event but only get a Webtraffic event when the Fortigate blocks a website; and then the URL filed has "http:\\Action=Blocked". So I only know what category was blocked but not site, nor on normal traffic do I have visibility (at the LEM - the Fortigate has teh info in its logs) into the actual URL visited by the user.
Has anyone else seen this?