Fortinet Document Library

Version:


Table of Contents

User Guide

Download PDF
Copy Link

Log Settings

To configure log settings, you need to click into an application, click Add Modules, then enable Log Settings.


Exporting attack logs

To export the attack logs to a log server:
  1. Go to Logs > Log Settings.
  2. Enable Attack Log Export.
  3. Click Add Log Server.
  4. Configure the following settings.

    Name

    Enter a name for the log server.

    Server Type

    Select whether to export the logs to a log server or an ElasticSearch service.

    See the following instructions for SysLog and ElasticSearch.

    SysLog

    IP/Domain and Port Enter the IP/Domain and Port of the log server.
    Protocol Select the protocol used for log transfer.

    Server Certificate Verification

    When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.

    Custom Certificate and Key
    • Off: FortiWeb Cloud automatically retrieves the SSL certificate used to encrypt the HTTPS connections between the log server and FortiWeb Cloud.
    • On: Manually enter the SSL certificate.

    Available only if you select SSL in Protocol.

    Client Certificate

    Fill in the Certificate field.

    Available only if you enabled Custom Certificate and Key.

    Private Key Fill in the Private Key field.
    Available only if you enabled Custom Certificate and Key.
    Password Enter the password of the private key.
    Available only if you enabled Custom Certificate and Key.
    Log Format
    • Default: Export logs in default format.
    • Custom: Customize the log format. All the supported parameters are listed by default. You can select the ones that you need, and delete the others.
    • Splunk: Export logs to Splunk log server.
    • CEF:0 (ArcSight): Export logs in CEF:0 format.
    • Microsoft Azure OMS: Export logs in Microsoft Azure OMS format.
    • LEEF1.0(QRadar): Export logs in LEEF1.0 format.

    Log Severity

    Select the severity level of the logs. All the exported logs will be attached with the selected severity level.

    Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use.

    ElasticSearch

    ElasticSearch is a search engine providing a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents.

    Address and Port

    Enter the address and port to access your ElasticSearch service.

    The default port for ElasticSearch service is 9200.

    User Name

    Enter the user name of the ElasticSearch service.

    Password

    Enter the password of the ElasticSearch service user.

  5. Click OK. The system exports newly generated attack logs to the log server every minute.

To prevent log poisoning, it's recommended to set filters on your log server to allow only the traffic from FortiWeb Cloud. The source IPs are as follows:

  • 3.226.2.163
  • 3.123.68.65

Configuring attack log alert

FortiWeb Cloud monitors the attack logs every five minutes, and sends alert email based on the set threat level. You can also customize a more complex rule for the alert email.

To configure an attack log alert:
  1. Go to Logs > Log Settings.
  2. Enable Attack Log Alerts.
  3. For Mode, when you select Basic, configure the following settings

    Threat Level

    The attacks of different threat levels are marked with the following values:

    • Critical: 50
    • High: 30
    • Medium: 10
    • Low: 5

    The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.

    Basic

    In basic mode, an alert email will be sent if the threat score is accumulated higher than the following value in 5 minutes:

    • 1 (low)
    • 100 (medium)
    • 400 (high)
    • 700 (critical)

    For example, if you set the Threat Level to medium, and the threat score is 130, then an alert email will be sent.

    Notification Recipient

    • Default—The alert email will be sent to the email address that is used to register your account.
    • Custom—Specify the email addresses to receive the alert.

    Custom Recipient

    Enter the email addresses. Separate multiple email addresses with ",".

    Available only if you select Custom for Notification Recipient.

  4. For Mode, when you select Advanced, click +Create Alert to customize a more complex rule. You can create at most five rules.
  5. Configure the following settings.

    Name

    Enter a name for the alert rule.

    Threat Score

    Specify a threat score for the attack log.

    The attacks of different threat levels are marked with the following values:

    • Critical: 50
    • High: 30
    • Medium: 10
    • Low: 5

    The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.

    If the actual threat score is higher than the score value you set, an alert email will be sent.

    Notification Recipient

    • Default—The alert email will be sent to the email address that is used to register your account.
    • Custom—Specify the email addresses to receive the alert.

    Custom Recipient

    Enter the email addresses. Separate multiple email addresses with ",".
    Available only if you select Custom for Notification Recipient.

  6. For Filter Overview, click Add Filter to create a filter based on attack log messages. Only messages that match the criteria in the filter will be calculated on the threat score.
  7. Click OK.

Sensitive Data Masking

Configure Sensitive Data Masking as part of Log Settings to mask information deemed sensitive in log message fields, such as passwords or credit card numbers. The Sensitive Data Masking settings are applied at the application level, with each application able to support up to 16 sensitive data rules.

To create a sensitive data rule:
  1. Go to Logs > Log Settings.
  2. Enable Sensitive Data Masking.
  3. Click +Sensitive Data Rule.
  4. Configure the following settings.
    Type

    Select the type of data the rule will apply to.

    • URL

    • Cookie

    • Parameter

    • Header

    Name

    Type a regular expression that matches all and only the input names whose values you want to obscure. To create a regular expression, see Frequently used regular expressions.

    This field is not required if URL data type is selected.

    Value

    Type a regular expression that matches all and only input values that you want to obscure. To create a regular expression, see Frequently used regular expressions.

  5. Click OK.

Log Settings

To configure log settings, you need to click into an application, click Add Modules, then enable Log Settings.


Exporting attack logs

To export the attack logs to a log server:
  1. Go to Logs > Log Settings.
  2. Enable Attack Log Export.
  3. Click Add Log Server.
  4. Configure the following settings.

    Name

    Enter a name for the log server.

    Server Type

    Select whether to export the logs to a log server or an ElasticSearch service.

    See the following instructions for SysLog and ElasticSearch.

    SysLog

    IP/Domain and Port Enter the IP/Domain and Port of the log server.
    Protocol Select the protocol used for log transfer.

    Server Certificate Verification

    When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.

    Custom Certificate and Key
    • Off: FortiWeb Cloud automatically retrieves the SSL certificate used to encrypt the HTTPS connections between the log server and FortiWeb Cloud.
    • On: Manually enter the SSL certificate.

    Available only if you select SSL in Protocol.

    Client Certificate

    Fill in the Certificate field.

    Available only if you enabled Custom Certificate and Key.

    Private Key Fill in the Private Key field.
    Available only if you enabled Custom Certificate and Key.
    Password Enter the password of the private key.
    Available only if you enabled Custom Certificate and Key.
    Log Format
    • Default: Export logs in default format.
    • Custom: Customize the log format. All the supported parameters are listed by default. You can select the ones that you need, and delete the others.
    • Splunk: Export logs to Splunk log server.
    • CEF:0 (ArcSight): Export logs in CEF:0 format.
    • Microsoft Azure OMS: Export logs in Microsoft Azure OMS format.
    • LEEF1.0(QRadar): Export logs in LEEF1.0 format.

    Log Severity

    Select the severity level of the logs. All the exported logs will be attached with the selected severity level.

    Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use.

    ElasticSearch

    ElasticSearch is a search engine providing a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents.

    Address and Port

    Enter the address and port to access your ElasticSearch service.

    The default port for ElasticSearch service is 9200.

    User Name

    Enter the user name of the ElasticSearch service.

    Password

    Enter the password of the ElasticSearch service user.

  5. Click OK. The system exports newly generated attack logs to the log server every minute.

To prevent log poisoning, it's recommended to set filters on your log server to allow only the traffic from FortiWeb Cloud. The source IPs are as follows:

  • 3.226.2.163
  • 3.123.68.65

Configuring attack log alert

FortiWeb Cloud monitors the attack logs every five minutes, and sends alert email based on the set threat level. You can also customize a more complex rule for the alert email.

To configure an attack log alert:
  1. Go to Logs > Log Settings.
  2. Enable Attack Log Alerts.
  3. For Mode, when you select Basic, configure the following settings

    Threat Level

    The attacks of different threat levels are marked with the following values:

    • Critical: 50
    • High: 30
    • Medium: 10
    • Low: 5

    The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.

    Basic

    In basic mode, an alert email will be sent if the threat score is accumulated higher than the following value in 5 minutes:

    • 1 (low)
    • 100 (medium)
    • 400 (high)
    • 700 (critical)

    For example, if you set the Threat Level to medium, and the threat score is 130, then an alert email will be sent.

    Notification Recipient

    • Default—The alert email will be sent to the email address that is used to register your account.
    • Custom—Specify the email addresses to receive the alert.

    Custom Recipient

    Enter the email addresses. Separate multiple email addresses with ",".

    Available only if you select Custom for Notification Recipient.

  4. For Mode, when you select Advanced, click +Create Alert to customize a more complex rule. You can create at most five rules.
  5. Configure the following settings.

    Name

    Enter a name for the alert rule.

    Threat Score

    Specify a threat score for the attack log.

    The attacks of different threat levels are marked with the following values:

    • Critical: 50
    • High: 30
    • Medium: 10
    • Low: 5

    The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.

    If the actual threat score is higher than the score value you set, an alert email will be sent.

    Notification Recipient

    • Default—The alert email will be sent to the email address that is used to register your account.
    • Custom—Specify the email addresses to receive the alert.

    Custom Recipient

    Enter the email addresses. Separate multiple email addresses with ",".
    Available only if you select Custom for Notification Recipient.

  6. For Filter Overview, click Add Filter to create a filter based on attack log messages. Only messages that match the criteria in the filter will be calculated on the threat score.
  7. Click OK.

Sensitive Data Masking

Configure Sensitive Data Masking as part of Log Settings to mask information deemed sensitive in log message fields, such as passwords or credit card numbers. The Sensitive Data Masking settings are applied at the application level, with each application able to support up to 16 sensitive data rules.

To create a sensitive data rule:
  1. Go to Logs > Log Settings.
  2. Enable Sensitive Data Masking.
  3. Click +Sensitive Data Rule.
  4. Configure the following settings.
    Type

    Select the type of data the rule will apply to.

    • URL

    • Cookie

    • Parameter

    • Header

    Name

    Type a regular expression that matches all and only the input names whose values you want to obscure. To create a regular expression, see Frequently used regular expressions.

    This field is not required if URL data type is selected.

    Value

    Type a regular expression that matches all and only input values that you want to obscure. To create a regular expression, see Frequently used regular expressions.

  5. Click OK.