Guides / Fortinet

Find AI tool usage in FortiGate web-filter logs

FortiGate's web filter writes a key=value line for every site your users touch. In regulated environments, those lines are the difference between "we think staff use chatbots" and a dated inventory you can hand an auditor.

Layer: firewall / web filter
Identity: user= via authentication or FSSO
Format: key=value syslog or CSV
Per-user table: yes, when auth is on
Run a free audit on a FortiGate export
The stakes in regulated networks

Why healthcare and finance audit FortiGate first

FortiGate is everywhere in hospitals, clinics and regional banks. Which means the evidence for the AI question those boards are now asking already exists on site.

The data is categorical

When a nurse pastes a discharge summary into a consumer chatbot, that is PHI at a vendor with unknown terms. The severity does not scale with intent, only with the tool's terms.

The question is already formal

Insurers, regulators and accreditation bodies now ask for AI usage inventories in writing. "We ran a dated log audit" is an answer; "we sent a survey" is not.

The sensor is installed

No procurement, no agents on clinical workstations, no change windows. One log export from the FortiGate you already run, uploaded once.

The healthcare-specific compliance angle, PHI in prompts and triage by training flags, is covered in depth on the HIPAA page. This guide stays on the mechanics.

Log anatomy

Reading a FortiGate web-filter line

FortiGate logs are key=value pairs, parsed natively by the audit. Four keys do the work; the rest ride along.

date=2026-09-15 time=11:42:07 devname="fg-hosp-01" type="utm" subtype="webfilter" action=passthrough user="clin\r.novak" srcip=10.61.4.88 dstip=104.18.3.94 hostname="chatgpt.com" url="/c/7d2f" catdesc="Information Technology" user="clin\r.novak" srcip=10.61.4.88 hostname="otter.ai" url="/u/meet" catdesc="Information Technology" user="admin\p.silva" srcip=10.61.9.31 hostname="quillbot.com" url="/paraphraser" catdesc="Education" user="" srcip=10.61.30.7 hostname="character.ai" url="/chat" catdesc="Games" action=blocked

The four keys that matter

  • hostname= the matched domain. The url= path is ignored and never appears in the report.
  • user= the authenticated identity via FSSO or captive auth. Empty user= lines fall back to srcip.
  • action= passthrough vs blocked, worth keeping for enforcement evidence.
  • date= / time= keep the window verifiable and re-runs comparable.

What the sample lines already show

  • One clinical user reaching a chatbot and a meeting transcriber back to back: the classic PHI-adjacent pair.
  • catdesc= filing AI tools under IT, Education and Games. Category filters were never going to catch this.
  • The blocked character.ai line on a guest-range IP: policy working, and demand worth knowing about.
Worked scenario

A hospital group reviews its chatbot exposure

Three-site hospital group, 2,400 staff, FortiGates at each site with FSSO on staff segments. Sample data, presented the way their own incident review ran.

Item 1: scope and evidence

Compliance requested a 30-day AI inventory after an insurer's questionnaire. IT exported web-filter syslog from all three FortiGates, concatenated: 610,000 lines, one full-report upload.

No agents touched clinical devices, which is why the review took days and not a quarter.

Item 2: findings

31 AI tools. Text and transcription dominate: two consumer chatbots with 214 combined users, one meeting transcriber with 41, one "medical scribe" AI trialing in a single department without procurement.

Register verdicts: both chatbots train unless opted out, the scribe's terms say nothing about training at all. Our wider analysis finds 85.5% of AI tools silent on training, and the scribe fit the pattern.

Item 3: the per-user reality

FSSO identities put names on the clinical-segment usage. The point was never discipline: it was discovering that an entire ward had normalized dictating notes into a consumer app.

Empty-user lines from shared kiosks appeared as source IPs, still countable, still assignable to a ward.

Item 4: disposition

The scribe trial got a proper DPIA and an enterprise contract with no-training terms. The consumer chatbots went to blocked with a sanctioned alternative announced the same day.

The audit PDF, with its dated verdicts, went into the insurer response verbatim. Re-audit scheduled quarterly.

Authentication dependency

The user= field decides your report's depth

FortiGate attribution quality tracks your authentication setup. All three states produce a valid audit.

FSSO on staff segments

Domain identities on every line. The per-user table names people, and coaching or migration lists write themselves.

Captive portal on Wi-Fi

Identities exist but may be transient. Expect the same person under a couple of session names across a long window.

No auth on kiosks and guests

user= is empty, srcip= stands in. You learn which stations and segments reach AI tools, which in a hospital is often the more important fact.

Output

What the report returns for a FortiGate export

Report sectionWith FortiGate web-filter logs
Summary tilesComplete totals: tools, high-risk, training exposure, abusive-purpose, unsanctioned.
Tool tableEvery matched hostname with category, risk, sovereignty and the dated training verdict.
Per-user tableFSSO and portal identities where present, srcip sources elsewhere, side by side.
Blocked vs allowedaction= preserved, so enforcement evidence and demand both stay visible.
Sanctioned splitYour approved tools against the observed list, the compliance number in one row.
CSV + PDFMachine-readable table plus the evidence pack, written to be filed as-is.

The export is read once and discarded. Paths in url= fields are never matched or shown. Reports live 90 days in the account and can be deleted earlier, which your privacy office will ask about.

FortiGate edges

Details that change how you read the results

FortiGuard categories mislabel AI

  • The sample lines above are real behavior: AI tools filed under IT, Education, even Games.
  • That is not a FortiGuard flaw, it is what happens when categories predate the tool wave. Per-domain matching is the fix.

Deep inspection is not required

  • Without SSL deep inspection, hostname= still populates from SNI, which is all the audit needs.
  • Do not expand decryption on clinical segments for this. The hostname evidence is already complete.

Multi-VDOM and multi-site merge fine

  • Concatenate slices across VDOMs and sites into one upload; devname= keeps them distinguishable for your own notes.
  • Caps: 2,000,000 lines or 25 MB per full report, larger on request via contact.

Guest Wi-Fi is its own finding

  • Patient and visitor segments reaching AI tools is expected; staff segments doing it through personal devices is the policy gap.
  • Segment-level srcip attribution is enough to see the difference.

See what a finished audit looks like

The sample evidence pack shows the document a FortiGate export produces: tiles, dated verdicts, the per-source breakdown. Sample data, no signup.

Open the sample PDF
The loop

Verdicts back into FortiGate, then prove it held

1. Static URL filter entries

Block-verdict domains from the report CSV go into a static URL filter or a custom category on the relevant policies. Abusive-purpose tools first, consumer chatbots per your decision.

2. Sanction the survivors

Control-verdict tools with real user counts become enterprise-tier procurements with no-training terms, then entries on your approved list for the next run's sanctioned split.

3. Quarterly re-run

Same window, all sites. Blocked tools should show action=blocked only; the delta slide writes the compliance narrative. Plans with monthly audits are on the pricing page.

Inventory first, then sanction, then block the remainder: the ordering argument is on detect before you block, and it matters double in hospitals where blunt blocking breaks legitimate clinical tools.

FAQ

FortiGate export questions

Which FortiGate log does the audit need?

Web-filter (utm/webfilter) logs as raw key=value syslog or CSV. Traffic logs work when they carry hostnames, but web-filter lines are the natural unit.

Do we need FortiAnalyzer?

No. Any path to the log lines works: FortiAnalyzer export, syslog collector slice or console download. The line format is what matters.

What if many lines have empty user= fields?

Those lines attribute to source IPs and segments instead. The tool inventory is unaffected; only name-level attribution narrows.

Is patient data at risk in the upload?

The audit reads hostnames, identities and timestamps. URL paths are discarded at parse time, the file is deleted after the run, and reports are deletable before their 90-day expiry.

Can we audit all three sites in one report?

Yes, concatenate the syslog slices. One report per site also works if you want per-site trend lines; both fit inside the same caps.

Why not rely on FortiGuard's AI category?

Coverage lags and granularity is coarse, as the catdesc= examples show. The audit adds dated training verdicts and the sanctioned split that category blocking cannot express.

Questionnaire mapping

Insurer and accreditor questions the report answers

The hospital group's insurer questionnaire mapped to report sections almost one to one. The common rows:

"List AI applications in use."

The tool table, exported as CSV. Dated, sourced from logs, and complete rather than remembered.

"Which process personal data?"

Training verdicts plus sovereignty flags per tool triage the list into review order for the privacy office.

"How is unauthorized use detected?"

"Quarterly log-based audit against a daily-maintained register" plus two PDF dates. That sentence closes the row.

"What controls exist?"

The blocked-vs-allowed evidence and the sanctioned split show both the enforcement and its adoption.

Sizing

How much FortiGate log fits one run

Web-filter volume tracks browsing, not total traffic, so files stay manageable longer than people expect.

Single clinic or branch

A month of web-filter lines usually sits in the tens of thousands. A filtered week can fit the free preview's 5,000 lines.

Hospital group scale

The scenario's 610,000 lines across three sites fit one full report comfortably. Keep only webfilter subtype lines to stay lean.

Beyond the caps

Over 2,000,000 lines or 25 MB, shorten the window, split per site, or ask us to take the whole file as a custom run.

The evidence is already on your FortiGate

Export thirty days of web-filter logs and read the free totals today. The hospital group's insurer answer started exactly there.

Run the free audit