Using URL risk-scores in determining policy action NEW
Risk level ratings can be added to the FortiGuard URL rating service. A FortiGate can query the rating service to retrieve the risk score for a URL. This risk score rates the likelihood that a website has malicious intent. It combines the results of machine learning models and human analysis together to predict how likely a given URL is malicious.
The risk score returned from FortiGuard is a value from 0-100, where:
|
Risk Score |
Risk Level |
Description |
|---|---|---|
|
91-100 |
High |
Strong confidence of malicious intent. |
|
71-90 |
Suspicious |
Medium confidence of malicious intent. |
|
51-70 |
Moderate |
Generally benign with a potential risk of attack. |
|
21-50 |
Low |
Low predictive risk of attack. |
|
1-20 |
Trustworthy |
Very low predictive risk of attack. |
|
0 |
Unrated |
The URL does not exist in FortiGuard DB or the risk score of the URL is unknown. |
The FortiGate can utilize this risk score and risk level in two different ways.
-
In a web filter profile, a risk level can be associated with the action Block or Monitor. When traffic hits a policy with the web filter profile applied, the URL will be used to query the FortiGuard URL rating service. If the risk score matches a level defined in the profile, the action is taken on that website.
The firewall policy must use proxy-based inspection. Either certificate or deep inspection will work with this feature.
-
In an explicit or transparent web proxy, a proxy-policy can be configured with a risk level. The risk level becomes a matching criteria for the policy.
Furthermore, the risk score range associated with each predefined level above cannot be modified on the FortiGate. However, new risk levels can be created with a custom range. These risk levels can be used within a web filter profile or within a proxy-policy.
Tie-breaker
In a web filter profile, when both risk level and web filter category are used, the action for the matched risk level will be ranked against the action for the matched web category.
Actions have the following weight order:
-
Block
-
Warning (Authenticate)
-
Monitor
-
Allow
When the action resulting from the risk level query and web filter category query return different actions, the action higher in the weight order will be performed. For example, a block and a warning action will result in the page being blocked.
When the actions returned are the same, then that action will be applied, and the replacement message and UTM log will indicate the decision was made by web filter category check.
Finally, if multiple risk levels are matched within a web filter profile, the action that has the higher weight will be applied.
Risk score override
A risk score can be overridden by a local risk-score override value. This override applies to a single URL specified in the object name.
CLI Syntax
The follow CLI syntax are included for introducing URL risk-scores to determine policy action:
-
Risk level configuration in a web filter profile:
config webfilter profile edit <name> set feature-set proxy config ftgd-wf unset options config risk edit <id> set risk-level <pre-defined or custom level> set action {block | monitor} set log {enable | disable} next end end next end -
Built-in read-only web filter local FortiGuard risk-level definition:
config webfilter ftgd-risk-level edit "high" set high 100 set low 91 next edit "suspicious" set high 90 set low 71 next edit "moderate" set high 70 set low 51 next edit "low" set high 50 set low 21 next edit "trustworthy" set high 20 set low 1 next edit "unrated" set high 0 set low 0 next end -
Custom user-defined web filter local FortiGuard risk-level:
config webfilter ftgd-risk-level edit <name> set high <score> set low <score> next end -
Web filter local FortiGuard risk-score override:
config webfilter ftgd-local-risk edit <url> set status {enable | disable} set comment <string> set risk-score <score> next end -
Applying risk-level to proxy-policy match:
config firewall proxy-policy edit <id> set url-risk <pre-defined or custom level> next end
Examples
The following examples demonstrate applying risk levels in different scenarios.
Two demo URLs are used for the examples:
|
Demo URL |
Risk score |
Default risk level |
|---|---|---|
|
58 |
Moderate |
|
|
46 |
Low |
In the web filter examples, the profile is applied to a firewall policy that utilizes proxy-based inspection and deep inspection.
Example 1: Applying the action block to the moderate risk level
To apply the action block to the moderate risk level:
config webfilter profile
edit "webfilter"
set feature-set proxy
config ftgd-wf
unset options
config risk
edit 1
set risk-level "moderate"
set action block
next
end
end
next
end
config firewall policy
edit 1
set name "WF"
set srcintf "port2"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set inspection-mode proxy
set profile-protocol-options "protocol"
set ssl-ssh-profile "protocols"
set webfilter-profile "webfilter"
set logtraffic all
set nat enable
next
end
When a client accesses www.example.com, the URL is blocked.
The following UTM log can be observed from CLI:
# execute log filter category utm-webfilter # execute log display 1: date=2024-11-20 time=09:45:19 eventtime=1732124719100876715 tz="-0800" logid="0316013058" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vdom1" policyid=1 poluuid="717176ae-97e7-51ef-2203-1f0b21e90462" policytype="policy" sessionid=6273 srcip=10.1.100.123 srcport=61545 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="8770b128-97cd-51ef-63d8-082966d66657" dstip=93.184.215.14 dstport=443 dstcountry="Belgium" dstintf="port1" dstintfrole="undefined" dstuuid="8770b128-97cd-51ef-63d8-082966d66657" proto=6 httpmethod="GET" service="HTTPS" hostname="www.example.com" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH" profile="webfilter" action="blocked" reqtype="direct" url="https://www.example.com/" sentbyte=4559 rcvdbyte=6070 direction="outgoing" msg="URL belongs to a denied risk-level in policy" ratemethod="domain" cat=255 urlrisk=58
Example 2: Overriding the URL's FortiGuard risk score with local risk score
To override the URL's FortiGuard risk score with local risk score:
config webfilter ftgd-local-risk
edit "www.example.com"
set risk-score 30
next
end
config webfilter profile
edit "webfilter"
set feature-set proxy
config ftgd-wf
unset options
config risk
edit 1
set risk-level "moderate"
set action block
next
edit 2
set risk-level "low"
next
end
end
set log-all-url enable
next
end
The low risk-level is added to the web filter profile, with the action monitor.
When a client accesses www.example.com, the URL is allowed.
The following UTM log can be observed from CLI:
1: date=2024-11-20 time=11:25:55 eventtime=1732130754321650374 tz="-0800" logid="0317013313" type="utm" subtype="webfilter" eventtype="ftgd_allow" level="notice" vd="vdom1" policyid=1 poluuid="717176ae-97e7-51ef-2203-1f0b21e90462" policytype="policy" sessionid=7648 srcip=10.1.100.123 srcport=61943 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="8770b128-97cd-51ef-63d8-082966d66657" dstip=93.184.215.14 dstport=443 dstcountry="Belgium" dstintf="port1" dstintfrole="undefined" dstuuid="8770b128-97cd-51ef-63d8-082966d66657" proto=6 httpmethod="GET" service="HTTPS" hostname="www.example.com" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH" profile="webfilter" action="passthrough" reqtype="direct" url="https://www.example.com/" sentbyte=3118 rcvdbyte=4927 direction="outgoing" msg="URL belongs to an allowed risk-level in policy" ratemethod="domain" cat=255 urlrisk=30
Example 3: Applying a user-defined risk level to the web filter profile
To apply a user-defined risk level to the web filter profile:
config webfilter ftgd-risk-level
edit "medium-safety"
set high 60
set low 30
next
end
config webfilter profile
edit "webfilter"
set feature-set proxy
config ftgd-wf
unset options
config risk
edit 1
set risk-level "medium-safety"
set action block
next
end
end
set log-all-url enable
next
end
When a client accesses www.example.com, the URL is blocked.
The following UTM log can be observed from CLI:
1: date=2024-11-20 time=11:58:46 eventtime=1732132726031604734 tz="-0800" logid="0316013058" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vdom1" policyid=1 poluuid="717176ae-97e7-51ef-2203-1f0b21e90462" policytype="policy" sessionid=8028 srcip=10.1.100.123 srcport=62051 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="8770b128-97cd-51ef-63d8-082966d66657" dstip=93.184.215.14 dstport=443 dstcountry="Belgium" dstintf="port1" dstintfrole="undefined" dstuuid="8770b128-97cd-51ef-63d8-082966d66657" proto=6 httpmethod="GET" service="HTTPS" hostname="www.example.com" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH" profile="webfilter" action="blocked" reqtype="direct" url="https://www.example.com/" sentbyte=2962 rcvdbyte=4927 direction="outgoing" msg="URL belongs to a denied risk-level in policy" ratemethod="domain" cat=255 urlrisk=58
Example 4: Matching an explicit web proxy policy by the URL’s risk level
A proxy-policy is configured to allow URLs that have low risk level.
To match an explicit web proxy policy by the URL’s risk level:
config firewall proxy-policy
edit 1
set name "Test"
set proxy explicit-web
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set url-risk "low"
set service "webproxy"
set action accept
set schedule "always"
set logtraffic all
set ssl-ssh-profile "protocols"
set log-http-transaction enable
next
end
When a client accesses www.httpbin.org, the URL is allowed.
Traffic log indicates the traffic matched proxy-policy 1:
# execute log filter category traffic # execute log display 2: date=2024-11-20 time=14:14:43 eventtime=1732140883609560183 tz="-0800" logid="0006000026" type="traffic" subtype="http-transaction" level="notice" vd="vdom1" srcip=10.1.100.123 srcport=64445 dstip=52.20.148.183 dstport=443 sessionid=1798921931 transid=150995356 action="accept" policyid=1 policytype="proxy-policy" poluuid="7b6afd8e-a78b-51ef-0ae5-5ddbd0defd25" url="https://www.httpbin.org/" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" appcat="unscanned" duration=1 reqlength=474 resplength=9751 rcvdbyte=15379 sentbyte=2809 scheme="https" hostname="www.httpbin.org" resptype="normal" httpmethod="GET" statuscode="200" reqtime=1732140882 resptime=1732140883 respfinishtime=1732140883
When a client accesses www.example.com, no proxy policy is matched. The URL is blocked.
Traffic log indicates the traffic is denied:
2: date=2024-11-20 time=14:19:17 eventtime=1732141157742504064 tz="-0800" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.1.100.123 srcport=64593 srcintf="port2" srcintfrole="undefined" dstip=93.184.215.14 dstport=443 dstintf="port1" dstintfrole="undefined" srccountry="Reserved" dstcountry="Belgium" sessionid=1798922057 proto=6 action="deny" policyid=0 policytype="proxy-policy" service="HTTPS" trandisp="noop" url="https://www.example.com/" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" appcat="unscanned" duration=0 sentbyte=222 rcvdbyte=0 sentpkt=0 rcvdpkt=0 crscore=30 craction=131072 crlevel="high" msg="Traffic denied because of explicit proxy policy"