Log Settings
Exporting attack logs
To export the attack logs to a log server:
- Go to Log Settings.
- Enable Attack Log Export.
- Click Add Log Server.
- Configure the following settings.
Name
Enter a name for the log server.
Server Type
Select whether to export the logs to a log server, an ElasticSearch service, FortiAnalyzer, or FortiSIEM.
See the following instructions for SysLog, ElasticSearch, FortiAnalyzer, and FortiSIEM
IP/Domain and Port Enter the IP/Domain and Port of the log server. Protocol Select the protocol used for log transfer. Server Certificate Verification
When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.
Custom Certificate and Key - Off: FortiWeb Cloud automatically retrieves the SSL certificate used to encrypt the HTTPS connections between the log server and FortiWeb Cloud.
- On: Manually enter the SSL certificate.
Available only if you select SSL in Protocol.
Client Certificate Fill in the Certificate field.
Available only if you enabled Custom Certificate and Key.
Private Key Fill in the Private Key field.
Available only if you enabled Custom Certificate and Key.Password Enter the password of the private key.
Available only if you enabled Custom Certificate and Key.Log Format - Default: Export logs in default format.
- Custom: Customize the log format. All the supported parameters are listed by default. You can select the ones that you need, and delete the others.
- Splunk: Export logs to Splunk log server.
- CEF:0 (ArcSight): Export logs in CEF:0 format.
- Microsoft Azure OMS: Export logs in Microsoft Azure OMS format.
- LEEF1.0(QRadar): Export logs in LEEF1.0 format.
Log Severity
Select the severity level of the logs. All the exported logs will be attached with the selected severity level.
Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use. ElasticSearch is a search engine providing a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents.
Address and Port
Enter the address and port to access your ElasticSearch service.
The default port for ElasticSearch service is 9200.
User Name
Enter the user name of the ElasticSearch service.
Password
Enter the password of the ElasticSearch service user.
FortiAnalyzer is a powerful log management, analytics, and reporting platform that provides centralized logging and analysis, plus end-to-end visibility.
*Please note that while FortiAnalyzer is supported, FortiAnalyzer Cloud is not.
IP/Domain and Port Enter the IP/Domain and Port of the log server. Protocol Select the protocol used for log transfer. Server Certificate Verification
When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.
Log Format Preview This box shows a preview of the log format, and is not editable.
Log Severity
Select the severity level of the logs. All the exported logs will be attached with the selected severity level.
Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use. IP/Domain and Port
Enter the IP/Domain and Port of the log server.
Protocol Select the protocol used for log transfer. Server Certificate Verification
When enabled, the system will enforces server certificate verification before it sends attack logs to the log server.
Log Format Preview This box shows a preview of the log format, and is not editable.
Log Severity
Select the severity level of the logs. All the exported logs will be attached with the selected severity level.
Log Facility Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use. - Click OK. The system exports newly generated attack logs to the log server every minute.
To prevent log poisoning, it's recommended to set filters on your log server to allow only the traffic from FortiWeb Cloud. The source IPs are as follows:
- 3.226.2.163
- 3.123.68.65
Configuring attack log alert
FortiWeb Cloud monitors the attack logs every five minutes, and sends alert email based on the set threat level. You can also customize a more complex rule for the alert email.
To configure an attack log alert:
- Go to Log Settings.
- Enable Attack Log Alerts.
- For Mode, when you select Basic, configure the following settings
Threat Level
The attacks of different threat levels are marked with the following values:
- Critical: 50
- High: 30
- Medium: 10
- Low: 5
The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.
Basic
In basic mode, an alert email will be sent if the threat score is accumulated higher than the following value in 5 minutes:
- 1 (low)
- 100 (medium)
- 400 (high)
- 700 (critical)
For example, if you set the Threat Level to medium, and the threat score is 130, then an alert email will be sent.
Notification Recipient
- Default—The alert email will be sent to the email address that is used to register your account.
- Custom—Specify the email addresses to receive the alert.
Custom Recipient
Enter the email addresses. Separate multiple email addresses with ",".
Available only if you select Custom for Notification Recipient.
- For Mode, when you select Advanced, click +Create Alert to customize a more complex rule. You can create at most five rules.
- Configure the following settings.
Name
Enter a name for the alert rule.
Threat Score
Specify a threat score for the attack log.
The attacks of different threat levels are marked with the following values:
- Critical: 50
- High: 30
- Medium: 10
- Low: 5
The system counts the threat score every 5 minutes. For example, if there are 2 critical attacks and 1 high threat level attack in 5 minutes, the threat score is 50*2+30=130.
If the actual threat score is higher than the score value you set, an alert email will be sent.
Notification Recipient
- Default—The alert email will be sent to the email address that is used to register your account.
- Custom—Specify the email addresses to receive the alert.
Custom Recipient
Enter the email addresses. Separate multiple email addresses with ",".
Available only if you select Custom for Notification Recipient. - For Filter Overview, click Add Filter to create a filter based on attack log messages. Only messages that match the criteria in the filter will be calculated on the threat score.
- Click OK.
Exporting traffic logs
Traffic logs record traffic events such as HTTP requests and responses, and the expiration of HTTP sessions. FortiWeb Cloud's Web UI doesn't show traffic logs, but you can export traffic logs to AWS S3 or Azure Blob bucket in real time for long-term storage, analysis, or alerting.
Please note that at this time, FortiWeb Cloud does not support exporting traffic logs to OCI (Oracle Cloud Infrastructure).
- Go to Log Settings.
- Enable Traffic Log Export.
- Configure the following settings.
Server Type
Select whether to export the logs to AWS S3 or Azure Blob.
AWS S3
Bucket name
Enter the AWS S3 bucket name.
Region
Enter the region code, for example, ap-southeast-1.
Access Key ID Enter the access key ID of the S3 bucket. Secret Key ID Enter the secret key ID of the S3 bucket. Prefix / Folder
Enter the prefix / folder to store the traffic log.
Azure Blob
Storage Account Name
Enter the Azure Blob storage account name
Account Access Key
Enter the Account Access Key for your storage account.
Container Name
Enter the name of the blob container to which you would like to export your traffic logs.
To use an S3 bucket for traffic export, the IAM role must have the following permissions enabled:
s3:PutObject
s3:GetObject
s3:GetBucketLocation
- Click Save.
|
|
To prevent log poisoning, it's recommended to set filters on your S3 bucket to allow only the traffic from FortiWeb Cloud. The source IPs from FortiWeb Cloud are as follows:
We also recommend adding the source IP addresses of traffic log exporting centers into the filter, corresponding to the region of your application. AWS:
Azure:
Google Cloud:
|
Sensitive Data Masking
Configure Sensitive Data Masking as part of Log Settings to mask information deemed sensitive in log message fields, such as passwords or credit card numbers. The Sensitive Data Masking settings are applied at the application level, with each application able to support up to 16 sensitive data rules.
To create a sensitive data rule:
- Go to Log Settings.
- Enable Sensitive Data Masking.
- Click +Sensitive Data Rule.
- Configure the following settings.
Type Select the type of data the rule will apply to.
URL
Cookie
Parameter
Header
Name Type a regular expression that matches all and only the input names whose values you want to obscure. To create a regular expression, see Frequently used regular expressions.
This field is not required if URL data type is selected.
Value Type a regular expression that matches all and only input values that you want to obscure. To create a regular expression, see Frequently used regular expressions.
- Click OK.
Retention and Periodic clean
All logs are periodically cleaned at the beginning of each month.
Please see table below for the retention information on each type of log:
|
Category |
Features |
Retention |
|---|---|---|
|
Incident |
Dashboard - Incidents |
90 days |
|
Dashboard - Top Incidents by Severity |
||
|
Threat Analytics - Incidents |
||
|
Attack log |
Threat Analytics -Attack log |
60 days
|
|
|
||
|
Dashboard - OWASP Top 10 Threats |
||
|
Dashboard - Threat Level History |
||
|
Dashboard - Top Known Threats |
||
|
Traffic log |
Dashboard - Traffic Statistics by Country |
60 days |
|
Traffic Summary |
||
| Audit log |
Audit log |
60 days |
|
On-Premise Device Attack log |
Threat Analytics - Attack log (on-premise device only) |
90 days |