After you have configured and applied auto-learning profiles, you can use them to collect data for an auto-learning report, and to suggest a configuration.
For faster results, from an external IP, connect to the website and access all URLs that a legitimate client would. Provide valid parameters. This activity populates auto-learning data with an initial, realistic set.
To improve performance during auto-learning, run it in a few phases.
For example, after an initial short phase of auto-learning, generate a protection profile with the most obvious attack settings. Then delete the auto-learning data, revise the protection profile to omit auto-learning for the settings that you have already discovered, and start the next phase of auto-learning.
Alternatively, you can run auto-learning on only a few policies at a time.
1. Enable the server policy where you have selected the auto-learning policy for Auto Learn Profile .
2. Route traffic to or through the FortiWeb appliance, depending on your operation mode.
|
For best results, do not use incomplete or unrealistic traffic. To minimize performance impacts, consider running an initial phase of auto-learning while your FortiWeb is operating in Offline Protection mode before you transition to your final choice of operation mode. |
3. Wait for the FortiWeb appliance to gather data.
To quickly reduce risk of attack while auto-learning is in progress, in the protection profile and its components, for attacks and disclosures that you are sure cannot be false positives, set the Action to Alert & Deny or Alert & Erase.
Time required varies by the rate of legitimate hits for each URL, the parameters that are included with each hit, and the percentage of hits that are attack attempts detected by attack signatures. You can gauge traffic volumes and hits using the Policy Summary widget. For details, see HTTP Throughput Monitor widget.
You can pause auto-learning’s data gathering if necessary. For details, see Pausing auto-learning for a URL.
4. Gauge progress by periodically reviewing the auto-learning report, which FortiWeb keeps up-to-date during auto-learning. For details, see Viewing auto-learning reports and Generating a profile from auto-learning data. If parameters are missing, auto-learning is not complete.
|
Auto-learning considers URLs up to approximately 128 characters long (assuming single-byte character encoding, after FortiWeb has decoded any nested hexadecimal or other URL encoding—therefore, the limit is somewhat dynamic). If the URL is longer than that buffer size, auto-learning cannot learn it, and therefore ignores it. No event log is generated. In those cases, you must manually configure FortiWeb protection settings for the URL, rather than discovering recommended protection settings via auto-learning. However, you may be able to re-use the settings recommended for other, shorter URLs by auto-learning. For example, if auto-learning discovers an email address parameter, it probably should have the same input constraints regardless of which URL uses it. |
5. If there is an unusual number of attacks, there are false positives, or if some auto-learning data is incorrect, you can do one of the following:
6. Continue with Generating a profile from auto-learning data.