Log Settings
This page includes configuration information for attack logs and traffic logs. For information on audit logs, please see Audit Logs Export.
Attack logs Export
Attack logs provide detailed insights for individual applications, helping track and analyze security events.
To export the attack logs to a log server:
- Go to Application > Log Settings.
- Enable Attack Log Export.
- Click Add Log Server.
- Configure the following settings.
Name
Enter a name for the log server.
Server Type
Select whether to export the logs to a log server, an ElasticSearch service, FortiAnalyzer, or FortiSIEM.
See the following instructions for SysLog, ElasticSearch, FortiAnalyzer, and FortiSIEM
IP/Domain and Port Enter the IP/Domain and Port of the log server. Protocol Select the protocol used for log transfer. Server Certificate Verification
When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.
Custom Certificate and Key - Off: FortiAppSec Cloud automatically retrieves the SSL certificate used to encrypt the HTTPS connections between the log server and FortiAppSec Cloud.
- On: Manually enter the SSL certificate.
Available only if you select SSL in Protocol.
Client Certificate Fill in the Certificate field.
Available only if you enabled Custom Certificate and Key.
Private Key Fill in the Private Key field.
Available only if you enabled Custom Certificate and Key.Password Enter the password of the private key.
Available only if you enabled Custom Certificate and Key.Log Format - Default: Export logs in default format.
- Custom: Customize the log format. All the supported parameters are listed by default. You can select the ones that you need, and delete the others. See Custom Log Fields
- Splunk: Export logs to Splunk log server.
- CEF:0 (ArcSight): Export logs in CEF:0 format.
- Microsoft Azure OMS: Export logs in Microsoft Azure OMS format.
- LEEF1.0(QRadar): Export logs in LEEF1.0 format.
Log Severity
Select the severity level of the logs. All the exported logs will be attached with the selected severity level.
Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use. ElasticSearch is a search engine providing a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents.
Address and Port
Enter the address and port to access your ElasticSearch service.
The default port for ElasticSearch service is 9200.
User Name
Enter the user name of the ElasticSearch service.
Password
Enter the password of the ElasticSearch service user.
FortiAnalyzer is a powerful log management, analytics, and reporting platform that provides centralized logging and analysis, plus end-to-end visibility.
Please note the following:
FortiAnalyzer is supported; however, FortiAnalyzer Cloud is not.
When configuring the corresponding ADOM on FortiAnalyzer, please set the Type to FortiWeb.
FortiAnalyzer supports assigning devices to different ADOMs, provided that each OU’s master account is associated with a distinct contract (i.e., a unique serial number).
However, if the organization has enabled Contract Sharing Mode, all OU accounts share the same contract and serial number. In this case, FortiAnalyzer treats them as a single device, which prevents assigning them to different ADOMs.
IP/Domain and Port Enter the IP/Domain and Port of the log server. Protocol Select the protocol used for log transfer. Server Certificate Verification
When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.
Log Format Preview This box shows a preview of the log format, and is not editable.
Log Severity
Select the severity level of the logs. All the exported logs will be attached with the selected severity level.
Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use. IP/Domain and Port
Enter the IP/Domain and Port of the log server.
Protocol Select the protocol used for log transfer. Server Certificate Verification
When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.
Log Format This box shows a preview of the log format, and is not editable.
Log Severity
Select the severity level of the logs. All the exported logs will be attached with the selected severity level.
Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use. - Click OK. The system exports newly generated attack logs to the log server every minute.
To prevent log poisoning, it's recommended to set filters on your log server to allow only the traffic from FortiAppSec Cloud. The source IPs are as follows:
- 3.226.2.163
- 3.123.68.65
Custom Log Fields
Below is a list of all supported log fields when Log Format is set to Custom.
|
Field Name |
Placeholder |
Example |
|---|---|---|
|
Date and Time |
dt |
2025-02-19T19:34:05-05:00 |
|
Date |
date |
2025-02-27 |
|
Time |
tm |
19:34:05 |
|
Time Zone |
tz |
-05:00 |
|
UTC Date |
utc |
2025-02-20T00:34:05 |
|
Timestamp |
ts |
1740011645000 |
|
Log Type ID |
li |
20000007 |
|
Message ID |
mid |
098765432123 |
|
Application ID |
eid |
1234567890 |
|
Application Name |
an |
ftnt-app1 |
|
Application Domain |
ed |
docs.fortinet.com |
|
Template Name |
tn |
My Template |
|
Source IP |
si |
0.00.000.00 |
|
Source Port |
sp |
80 |
|
Destination IP |
ds |
123.456.789.0 |
|
Destination Port |
dp |
443 |
|
Source Country |
sc |
Canada |
|
Service |
svc |
https/tls1.3 |
|
Login User |
lu |
Unknown |
|
Main Type of Threat |
mt |
Known Attacks |
|
Sub Type of Threat |
st |
Cross Site Scripting |
|
Threat Level |
tl |
Severe |
|
Threat Weight |
tw |
10 |
|
Action |
act |
Block |
|
HTTP Host |
hh |
fortinet.com |
|
HTTP URL |
hu |
/ContactUs.aspx |
|
HTTP Version |
hv |
1.x |
|
HTTP Method |
hm |
POST |
|
HTTP Agent |
ha |
gp-vcloud-director |
|
HTTP Refer |
hr |
none |
|
Signature ID |
sid |
010000009 |
|
Signature CVE ID |
sci |
N/A |
|
OWASP Top10 |
ott |
A03:2021-Injection |
|
Message |
msg |
Parameter(emailID) triggered signature ID 010000009 of Signatures |
|
Packet |
pkt |
"packet string" |
FortiAppSec Cloud monitors the attack logs every five minutes, and sends alert email based on the set threat level. You can also customize a more complex rule for the alert email.
To configure an attack log alert:
- Go to Log Settings.
- Enable Attack Log Alerts.
- For Mode, when you select Basic, configure the following settings
Threat Level
The attacks of different threat levels are marked with the following values:
- Critical: 50
- High: 30
- Medium: 10
- Low: 5
The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.
Basic
In basic mode, an alert email will be sent if the threat score is accumulated higher than the following value in 5 minutes:
- 1 (low)
- 100 (medium)
- 400 (high)
- 700 (critical)
For example, if you set the Threat Level to medium, and the threat score is 130, then an alert email will be sent.
Notification Recipient
- Default—The alert email will be sent to the email address that is used to register your account.
- Custom—Specify the email addresses to receive the alert.
Custom Recipient
Enter the email addresses. Separate multiple email addresses with ",".
Available only if you select Custom for Notification Recipient.
- For Mode, when you select Advanced, click +Create Alert to customize a more complex rule. You can create at most two rules.
- Configure the following settings.
Name
Enter a name for the alert rule.
Threat Score
Specify a threat score for the attack log.
The attacks of different threat levels are marked with the following values:
- Critical: 50
- High: 30
- Medium: 10
- Low: 5
The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.
If the actual threat score is higher than the score value you set, an alert email will be sent.
Notification Recipient
- Default—The alert email will be sent to the email address that is used to register your account.
- Custom—Specify the email addresses to receive the alert.
Custom Recipient
Enter the email addresses. Separate multiple email addresses with ",".
Available only if you select Custom for Notification Recipient. - For Filter Overview, click Add Filter to create a filter based on attack log messages. Only messages that match the criteria in the filter will be calculated on the threat score.
- Click OK.
Exporting traffic logs
Traffic logs record traffic events such as HTTP requests and responses, and the expiration of HTTP sessions. FortiAppSec Cloud's Web UI doesn't show traffic logs, but you can export traffic logs to AWS S3 or Azure Blob bucket in real time for long-term storage, analysis, or alerting.
Please note that at this time, FortiAppSec Cloud does not support exporting traffic logs to OCI (Oracle Cloud Infrastructure).
- Go to Log Settings.
- Enable Traffic Log Export.
- Configure the following settings.
Server Type
Select whether to export the logs to AWS S3 or Azure Blob.
AWS S3
Bucket name
Enter the AWS S3 bucket name.
Region
Enter the region code, for example, ap-southeast-1.
Access Key ID Enter the access key ID of the S3 bucket. Secret Key ID Enter the secret key ID of the S3 bucket. Folder
Enter the folder to store the traffic log.
Azure Blob
Storage Account Name
Enter the Azure Blob storage account name
Account Access Key
Enter the Account Access Key for your storage account.
Container Name
Enter the name of the blob container to which you would like to export your traffic logs.
To use an S3 bucket for traffic export, the IAM role must have the following permissions enabled:
s3:PutObject
s3:GetObject
s3:GetBucketLocation
- Click Save.
|
|
To prevent log poisoning, it's recommended to set filters on your S3 bucket to allow only the traffic from FortiAppSec Cloud. The source IPs from FortiAppSec Cloud are as follows:
We also recommend adding the source IP addresses of traffic log exporting centers into the filter, corresponding to the region of your application. AWS:
Azure:
Google Cloud:
|
Sensitive Data Masking
Configure Sensitive Data Masking as part of Log Settings to mask information deemed sensitive in log message fields, such as passwords or credit card numbers. The Sensitive Data Masking settings are applied at the application level, with each application able to support up to 8 sensitive data rules.
To create a sensitive data rule:
- Go to Log Settings.
- Enable Sensitive Data Masking.
- Click +Sensitive Data Rule.
- Configure the following settings.
Type Select the type of data the rule will apply to.
URL
Cookie
Parameter
Header
Name Type a regular expression that matches all and only the input names whose values you want to obscure. To create a regular expression, see Frequently used regular expressions.
This field is not required if URL data type is selected.
Value Type a regular expression that matches all and only input values that you want to obscure. To create a regular expression, see Frequently used regular expressions.
- Click OK.
Retention and Periodic clean
All logs are periodically cleaned at the beginning of each month.
Please see table below for the retention information on each type of log:
|
Category |
Features |
Retention |
|---|---|---|
|
Incident |
Dashboard - Incidents |
90 days |
|
Dashboard - Top Incidents by Severity |
||
|
Threat Analytics - Incidents |
||
|
Attack log |
Threat Analytics -Attack log |
60 days
|
|
|
||
|
Dashboard - OWASP Top 10 Threats |
||
|
Dashboard - Threat Level History |
||
|
Dashboard - Top Known Threats |
||
|
Traffic log |
Dashboard - Traffic Statistics by Country |
60 days |
|
Traffic Summary |
||
| Audit log |
Audit log |
90 days |
|
On-Premise Device Attack log |
Threat Analytics - Attack log (on-premise device only) |
90 days |