Attack

Attack log messages record traffic that violated its matching policy. Log ID numbers of this type are listed in the table Attack logs by subtype & ID.

The operating mode, network topology, and the rule’s configured Action can all affect how a policy responds to an attack, data leak, or server information disclosure. Depending on your configuration, violating traffic is either:

• blocked
• sanitized, then passed through
• allowed to continue unmodified (that is, logged only)

Attacks that generate log messages periodically

FortiWeb does not record the following types of attack logs individually. Instead, it records them periodically while the attack is ongoing, even if the attack has multiple sources:

• DoS attacks
• Padding oracle attacks
• HTTP/HTTPS protocol constraints

This aggregation prevents FortiWeb from flooding attack logs with identical or very similar messages. To differentiate logs caused by individual attacks from those caused by multiple attacks in the same category, FortiWeb records whether it generated the attack log message after matching multiple signatures.

In the attack log, the message field of aggregated log messages displays the message rule_name : Custom Access Violation.

In aggregated attacks log, the type field displays the message Multiple Custom access rule Violations.

Logging for threat scoring

By default, FortiWeb does not display all signature violations that contributed to a threat scoring attack log message as individual entries in the attack log. Instead, a single attack log message is displayed for the signature violations that contributed to a combined threat score that exceeded the maximum. However, all the signature violations that contributed to the score are displayed in the message details. (Double-click the message to display its details.)

Also by default, FortiWeb does not display messages for signature violations that generated a threat score but did not exceed the threat scoring threshold.

Use the following CLI command to display the signature violations that contributed to a threat scoring attack log message as individual entries and to display any signature violations that generated a threat score but did not exceed the threat scoring threshold:

config log attack-log

set show-all-log {enable | disable}

For more information on CLI commands, see FortiWeb CLI Reference.

Threat scoring attack log messages are also displayed in the aggregated attacks log.

Attack log descriptions

To locate a description for an attack log message, match the ID (log_id) field in the attack log message with that shown in the table Attack logs by subtype & ID. All attack log messages have the same body fields, described in Attack log fields.

For attack log messages generated by a HTTP protocol constraint, the associated policy name is displayed in the raw view ([policy_name:<protocol_constraint_name>]) but not in the formatted view.

Attack logs by subtype & ID

Open topic with navigation