Skip to content

Fortinet Fortiweb

Overview

This documentation details one way to collect and send FortiWeb logs to Sekoia.io: from the FortiWeb machine to an internal syslog concentrator, then forwarded to Sekoia.io

The following Sekoia.io built-in rules match the intake Fortinet FortiWeb. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Fortinet FortiWeb on ATT&CK Navigator

Nimbo-C2 User Agent

Nimbo-C2 Uses an unusual User-Agent format in its implants.

  • Effort: intermediate
Potential Azure AD Phishing Page (Adversary-in-the-Middle)

Detects an HTTP request to an URL typical of the Azure AD authentication flow, but towards a domain that is not one the legitimate Microsoft domains used for Azure AD authentication.

  • Effort: intermediate
Potential Bazar Loader User-Agents

Detects potential Bazar loader communications through the user-agent

  • Effort: elementary
Potential Lemon Duck User-Agent

Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".

  • Effort: elementary
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Web application firewall logs date_source: "Fortinet WAF"

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "time=16:58:13 log_id=30001000 msg_id=000669319381 device_id=FVVM010000207514 vd=\"root\" timezone=\"(GMT+1:00)Brussels,Copenhagen,Madrid,Paris\" timezone_dayst=\"GMTc-2\" type=traffic subtype=\"https\" pri=notice proto=tcp service=https/tls1.2 status=success reason=none policy=extranet original_src=192.168.36.2 src=192.168.36.2 src_port=48152 dst=172.26.8.20 dst_port=80 http_request_time=0 http_response_time=0 http_request_bytes=549 http_response_bytes=11272 http_method=get http_url=\"/apiv1/wan/list?take=12&skip=84&orderBy=ponderationValue&sortDirection=desc&filter[]=monitor,equalsBool,true&filter[]=status,equal,DOWN\" http_agent=\"Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36\" http_retcode=200 msg=\"HTTPS get request from 192.168.36.2:48152 to 172.26.8.20:80\" original_srccountry=\"Reserved\" srccountry=\"Reserved\" content_switch_name=\"none\" server_pool_name=\"extranet.sns-security.fr\" http_host=\"api.sns-security.fr\" user_name=\"Unknown\" http_refer=\"https://technet.sns-security.fr/\" http_version=\"1.x\" dev_id=none cipher_suite=\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\"",
    "event": {
        "category": "https",
        "kind": "traffic",
        "message": "HTTPS get request from 192.168.36.2:48152 to 172.26.8.20:80",
        "outcome": "success"
    },
    "action": {
        "outcome": "success",
        "outcome_reason": "none",
        "properties": {
            "device_id": "FVVM010000207514",
            "log_id": "30001000"
        }
    },
    "destination": {
        "address": "172.26.8.20",
        "ip": "172.26.8.20",
        "port": 80
    },
    "host": {
        "name": "tyR4LrYORLPlEIBp"
    },
    "http": {
        "request": {
            "bytes": 549,
            "method": "get",
            "referrer": "https://technet.sns-security.fr/"
        },
        "response": {
            "bytes": 11272,
            "status_code": 200
        },
        "version": "1.x"
    },
    "log": {
        "hostname": "tyR4LrYORLPlEIBp",
        "level": "notice"
    },
    "network": {
        "protocol": "tcp"
    },
    "related": {
        "ip": [
            "172.26.8.20",
            "192.168.36.2"
        ]
    },
    "rule": {
        "ruleset": "extranet"
    },
    "source": {
        "address": "192.168.36.2",
        "geo": {
            "name": "Reserved"
        },
        "ip": "192.168.36.2",
        "port": 48152
    },
    "tls": {
        "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
    },
    "url": {
        "path": "/apiv1/wan/list?take=12&skip=84&orderBy=ponderationValue&sortDirection=desc&filter[]=monitor,equalsBool,true&filter[]=status,equal,DOWN",
        "username": "Unknown"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Chromium",
        "original": "Mozilla/5.0 (X11; Linux armv7l) AppleWebKit/537.36 (KHTML, like Gecko) Raspbian Chromium/72.0.3626.121 Chrome/72.0.3626.121 Safari/537.36",
        "os": {
            "name": "Linux"
        },
        "version": "72.0.3626"
    }
}

{
    "message": "time=10:48:07 log_id=11005607 msg_id=000669559376 device_id=FVVM010000207514 vd=\"root\" timezone=\"(GMT+1:00)Brussels,Copenhagen,Madrid,Paris\" timezone_dayst=\"GMTc-2\" type=event subtype=\"system\" pri=notice trigger_policy=\"\" user=daemon ui=daemon action=check-resource status=success msg=\"The logdisk usage is too high\" ",
    "event": {
        "action": "check-resource",
        "category": "system",
        "kind": "event",
        "message": "The logdisk usage is too high",
        "outcome": "success"
    },
    "action": {
        "outcome": "success",
        "properties": {
            "device_id": "FVVM010000207514",
            "log_id": "11005607"
        }
    },
    "host": {
        "name": "vnx1hO5mF0pK4IR1"
    },
    "log": {
        "hostname": "vnx1hO5mF0pK4IR1",
        "level": "notice"
    },
    "related": {
        "user": [
            "daemon"
        ]
    },
    "user": {
        "name": "daemon"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
action.properties.device_id keyword
action.properties.log_id keyword
destination.ip ip IP address of the destination.
destination.port long Port of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
http.request.bytes long Total size in bytes of the request (body and headers).
http.request.method keyword HTTP request method.
http.request.referrer keyword Referrer for this HTTP request.
http.response.bytes long Total size in bytes of the response (body and headers).
http.response.status_code long HTTP response status code.
http.version keyword HTTP version.
log.level keyword Log level of the log event.
network.protocol keyword Application protocol name.
rule.ruleset keyword Rule ruleset
source.geo.name keyword User-defined description of a location.
source.ip ip IP address of the source.
source.port long Port of the source.
tls.cipher keyword String indicating the cipher used during the current connection.
url.path wildcard Path of the request, such as "/search".
url.username keyword Username of the request.
user.name keyword Short name or login of the user.
user_agent.original keyword Unparsed user_agent string.

Configure

On FortiWeb appliances, most of the important hardware and software activities that are relevant for security detection and analysis, are logged into three files.

  • Traffic: Displays traffic flow information, such as HTTP/HTTPS requests and responses.
  • Event: Displays administrative events, such as downloading a backup copy of the configuration, and hardware failures.
  • Attack: Displays attack and intrusion attempt events.

Transport to the concentrator

The following prerequisites are needed in order to setup efficient log concentration: - Have administrator writes on the FortiWeb (read & write permission) - Traffic towards the syslog concentrator must be open on UDP 514

Configure FortiWeb

Enable logging via trigger mechanism

  1. Go to Log&Report > Log Config > Other Log Settings
  2. Tick the boxes : Enable Attack Log / Enable Traffic Log / Enable Event Log

Configure Syslog policies

  1. Go to Log&Report > Log Policy > Syslog Policy.

To access this part of the web UI, your administrator’s account access profile must have Read and Write permission to items in the Log & Report category. For details, see Permissions.

  1. Click Create New.

If the policy is new, in Policy Name, type the name of the policy as it will be referenced in the configuration.

  1. Click Create New.
  2. In IP Address, enter the address of the remote Syslog server.
  3. In Port, enter the listening port number of the Syslog server. The default is 514.
  4. Click OK.

Configure log destinations

  1. Go to Log&Report > Log Config > Global Log Settings
  2. Tick the syslog box
  3. Select the relevant Syslog Policy, Log Level and Facility
  4. Click Apply

For more information please refer to the official documentation of FortiWeb

Forward logs to Sekoia.io

The reader is invited to consult the Syslog Forwarding documentation to forward these logs to Sekoia.io.