No InlineResult on IPS logs

[Integration Support]

Hi everyone,

I have recently set up a remote syslog server and configured syslog logging for Cisco FTD (v7.6.4) via FMC.

The logs are being sent and received as expected. Here is an example of an IPS event log from the syslog server:

<41>Sep 2 08:48:28 fmc TestAlert: [1:12798:10] "INDICATOR-SHELLCODE base64 x86 NOOP" [Impact: Currently Not Vulnerable] From "ftd" at Wed Sep 2 08:48:25 2026 UTC [Classification: Executable Code was Detected] [Priority: 1] {tcp} x.x.x.x:80 (france)->x.x.x.x:49331 (unknown)

While the InlineResult action (e.g., Block/Alert) is visible within the FMC GUI, it does not appear to be included in the generated syslog output.

Is there a configuration or setting available in FMC/FTD to include the InlineResult field directly in the syslog stream?

Thanks in advance,

[Marvin Rhoads]

If you have set the access control policy rule to log the associated connection events, that should generate an event with the associated action and reason (e.g., Block, Intrusion Event).

[Integration Support]

Hi Marvin,

Thank you for your reply!

The Access rule logging is enable, but still no result.