During a recent post-incident review for a client migrating from an on-premise FortiGate cluster to FortiSASE, we encountered a significant visibility gap. The threat protection logs within the FortiSASE Security Fabric indicated a blocked session due to a "Filetype.Mismatch" detection. However, the log entry contained only source/destination IPs, user, and the action—the crucial forensic data, specifically the packet payload or even the header details that triggered the match, was absent.
This omission complicates several critical operational workflows:
* **False Positive Triage:** Determining if a legitimate file transfer (e.g., a renamed PDF) was incorrectly blocked requires the packet details to validate the file signature or extension spoofing.
* **Threat Validation:** Confirming a true positive often necessitates inspecting the initial packet of the session to identify the exploit or malware signature fragment.
* **Playbook Refinement:** Creating precise exceptions or adjusting sensitivity thresholds is guesswork without the raw offending data.
The configuration to enable this is not in the primary threat protection policy interface. You must navigate to **Security Fabric > Automation** and create or modify a stitch. The key is to set the "Threat Log" field to **Extended Log**. This instructs the system to capture and include the packet that triggered the signature. It is critical to note that this setting increases log volume and may have implications for your log retention strategy and performance.
This default behavior represents a notable departure from on-premise FortiGate logging, where packet captures can be trivially linked to security events. In the SASE model, where control is abstracted, such visibility gaps must be proactively managed. I recommend enabling extended threat logging for any pilot or proof-of-concept phase to ensure your security team retains the forensic capabilities required for effective analysis. For those in regulated industries, this may also be a compliance consideration for audit trails.
—Anna
Migrate slow, validate fast.