An administrator is examining the attack logs and notices the following entry: type=ips subtype=signature pri=alert vd=root serial=1995 attack_id=103022611 src=69.45.64.22 dst=192.168.1.100 src_port=8

The `msg=web_client: IE.IFRAME.BufferOverflow.B` clearly indicates a client-side exploit (targeting a web browser like Internet Explorer), not an attack against an HTTP server.

The `status=detected` field in the log explicitly means the attack was identified but not blocked; if it were blocked, the status would typically be `blocked` or `prevented`.

The log entry shows `dst=192.168.1.100` and `dst_int=internal`; if 192.168.1.100 is the IP address of the FortiGate unit's internal interface, then the attack was directed at the FortiGate unit itself.

The `status=detected` in a FortiGate IPS log specifically indicates that an attack signature was identified, but the configured action for that signature or policy was to allow the traffic to pass rather than actively block it.