Log Settings
This page includes configuration information for attack logs and traffic logs. For information on audit logs, please see Audit Logs Export.
Attack Log Alerts
Enable to receive Attack Log alerts for this application. To export Attack logs, please navigate to Threat Analytics > Settings.
-
Navigate to Log Settings.
-
Enable Attack Log Alerts.
-
Select the Mode, which determines the set of configuration options available for defining your attack log alert settings.
-
If you selected Basic, configure the following:
Threat Level
Set the lowest threat level you want to receive notifications for.
-
Low: Receive notifications for all threat analytics events.
-
Moderate: Receive notifications for Moderate and High threat events.
-
High: Receive notifications for High threat events.
-
Critical: Receive notifications for Critical threat events.
Notification Recipient
-
Default: Select to send attack log alerts to the email address already associated with this application.
-
Custom: Enter up to 10 email addresses to receive these notifications, separated by commas.
-
-
If you selected Advanced, click Create Alert and configure the following:
Name
The internal name by which this set of notification rules is displayed.
Threat Score
Set the lowest threat score you want to receive notifications for.
The system calculates a threat score every 5 minutes by aggregating attack scores based on their severity.
For instance, if there are two critical attacks (score of 50 each) and one high-level attack (score of 30) within this timeframe, the total threat score is calculated as 50*2+30=130.
Threat Scores and their corresponding severity levels:
-
1 (low)
-
100 (medium)
-
400 (high)
-
700 (critical)
Notification Recipient
-
Default: Select to send attack log alerts to the email address already associated with this application.
-
Custom: Enter up to 10 email addresses to receive these notifications, separated by commas.
Filter Overview
Click Add Filter to define more conditions for attack logs that should trigger alerts.
-
In the left-most dropdown, select an attribute:
-
Source IP
-
User Agent
-
URL
-
Threat Main Type
-
Threat Sub Type
-
Signature ID
-
-
Use the Operator and Value fields to specify the condition.
-
Click Save Filter before adding another filter.
-
-
-
Click Save to apply changes.
Exporting traffic logs
Traffic logs record traffic events such as HTTP requests and responses, and the expiration of HTTP sessions. FortiAppSec Cloud's Web UI doesn't show traffic logs, but you can export traffic logs to AWS S3 or Azure Blob bucket in real time for long-term storage, analysis, or alerting.
|
Log timestamps may differ between the portal and exported files.
|
- Go to Log Settings.
- Enable Traffic Log Export.
- Configure the following settings.
Server Type
Select whether to export the logs to AWS S3 or Azure Blob.
AWS S3
Bucket name
Enter the AWS S3 bucket name.
Region
Enter the region code, for example, ap-southeast-1.
Access Key ID Enter the access key ID of the S3 bucket. Secret Key ID Enter the secret key ID of the S3 bucket. Folder
Enter the folder to store the traffic log.
Azure Blob
Storage Account Name
Enter the Azure Blob storage account name
Account Access Key
Enter the Account Access Key for your storage account.
Container Name
Enter the name of the blob container to which you would like to export your traffic logs.
To use an S3 bucket for traffic export, the IAM role must have the following permissions enabled:
s3:PutObject
s3:GetObject
s3:GetBucketLocation
- Click Save.
|
|
To prevent log poisoning, it's recommended to set filters on your S3 bucket to allow only the traffic from FortiAppSec Cloud. The source IPs from FortiAppSec Cloud are as follows:
We also recommend adding the source IP addresses of traffic log exporting centers into the filter, corresponding to the region of your application. AWS:
Azure:
Google Cloud:
|
Sensitive Data Masking
Configure Sensitive Data Masking as part of Log Settings to mask information deemed sensitive in log message fields, such as passwords or credit card numbers. The Sensitive Data Masking settings are applied at the application level, with each application able to support up to 8 sensitive data rules.
To create a sensitive data rule:
- Go to Log Settings.
- Enable Sensitive Data Masking.
- Click +Sensitive Data Rule.
- Configure the following settings.
Type Select the type of data the rule will apply to.
URL
Cookie
Parameter
Header
Name Type a regular expression that matches all and only the input names whose values you want to obscure. To create a regular expression, see Frequently used regular expressions.
This field is not required if URL data type is selected.
Value Type a regular expression that matches all and only input values that you want to obscure. To create a regular expression, see Frequently used regular expressions.
- Click OK.
Retention and Periodic clean
All logs are periodically cleaned at the beginning of each month.
Please see table below for the retention information on each type of log:
|
Category |
Features |
Retention |
|---|---|---|
|
Incident |
Dashboard - Incidents |
60 days |
|
Dashboard - Top Incidents by Severity |
||
|
Threat Analytics - Incidents |
||
|
Attack log |
Threat Analytics -Attack log |
60 days
|
|
|
||
|
Dashboard - OWASP Top 10 Threats |
||
|
Dashboard - Threat Level History |
||
|
Dashboard - Top Known Threats |
||
|
Traffic log |
Dashboard - Traffic Statistics by Country |
60 days |
|
Traffic Summary |
||
| Audit log |
Audit log |
90 days |
|
On-Premise Device Attack log |
Threat Analytics - Attack log (on-premise device only) |
60 days, or until storage capacity (20 GB × number of devices) is reached, whichever threshold is met first. |
|
Diagnostics Report |
Diagnostics |
90 days |