Security Profiles, Logging, and Monitoring
Profiles and inspection
Security profiles add content inspection on top of a permitting policy: antivirus, intrusion prevention, web filtering, application control, DNS filtering, file filtering, and data-loss prevention. A profile only acts if it is attached to a policy, and inspection depth depends on the mode - flow-based inspection is faster but may miss some evasions, while proxy-based inspection can reconstruct content more thoroughly. Encrypted traffic remains opaque unless deep inspection is enabled, which requires a trusted certificate chain on clients and an exemption list for privacy-sensitive or pinned applications.
Logging
Logs are the evidence trail. Distinguish traffic logs (session metadata), event logs (system and admin actions), and security logs (profile detections). Severity levels rank urgency, not whether an action occurred; a high-severity alert may still be a block or only a detect. Logging can be local, sent to syslog, or forwarded to a SIEM. Disabling logging on the implicit deny removes one of the most useful signals during troubleshooting and incident review.
Monitoring
Use SNMP and flow export for health and traffic baselines, dashboards for session counts and resource pressure, and alerts for policy changes and profile events. Traps include assuming a profile blocked traffic when it only detected, confusing severity with action, and forgetting that encrypted sessions bypass content profiles without deep inspection.
Rule of thumb
When asked why a threat was not blocked, check three things in order: was the profile attached to the matching policy, was the inspection mode capable of seeing the content, and was the action set to block rather than monitor? Then confirm the event was logged.