This help contains the following topics:

·     Introduction

·     Restrictions and guidelines

·     Manage threat logs

¡     Viewing threat log details

¡     Downloading capture files

¡     Adding to whitelist

¡     Import logs

¡     Export logs

¡     Aggregate logs

Introduction

The Threat Log List page displays the logs generated by the IPS module and the anti-virus module. These logs help administrators customize IPS profiles and anti-virus profiles to improve network security.

When configuring an IPS profile or anti-virus profile, you can enable the logging function. The IPS module and anti-virus module can then generate logs for matching packets.

Restrictions and guidelines

·     Only one log operation (import, export, or delete) is allowed at a time.

·     Only one user can perform a log operation at a time. When you import, export, or delete logs, make sure no one else is performing a log operation.

·     When querying logs of a time range, this page displays the logs of the first day by default. You can click Previous Day or Next Day to view the logs of a specific date.

Manage threat logs

Viewing threat log details

To view details of a log, click the Details icon  in the Details column. In the Threat Log Details window, the threat name in the Threat information area and the fields in the Packet Details area may be incompletely displayed. To view the complete content, you can use the following methods:

·     Hover over the content.

·     Click Copy. On the window that opens, obtain the complete content.

Downloading capture files

After the intrusion prevention system executes the packet capture action, the device generates logs. With hard disks or USB disks installed, you can click Download of a log to obtain the captured file for threat analysis.

Adding to whitelist

If false alarms exist in the threat logs, you can click the Add to whitelist icon of a log to add the detected IPS signature ID and URL to the whitelist. The whitelist feature permits packets matching the whitelist to pass through, reducing false alarms.

Import logs

1.     Click the Monitor tab.

2.     In the navigation pane, select Security Logs > Threat Logs.

3.     Click Import.

4.     In the dialog box that opens, click Yes.

5.     Select a log file, and enter the password for the log file. The password was set when the file was exported.

Export logs

1.     Click the Monitor tab.

2.     In the navigation pane, select Security Logs > Threat Logs.

3.     Click Advanced search.

4.     On the page that opens, specify the search criteria to display the logs to be exported.

5.     Click Export.

6.     On the page that opens, configure the log export settings.

Table 1 Log export configuration items

Item	Description
Set password	Enter a password for encrypting the log files. This password is required when you view or import the exported log files.
Log range	Specify the range of logs to be exported. Options are: ·     All results—Exports all logs that satisfy the search criteria. The page displays the total number of logs to be exported. ·     Day on the current page—Exports logs of the day indicated by the Time field on the current page. You can define the ending page to decrease the number of logs to be exported.

 

7.     Select one of the following export methods.

¡     Export to one file—Exports logs to one file. When a small number of logs are to be exported, select this method.

¡     Export to files—Exports logs to multiple files. If more than 65000 logs are to be exported, select this method.

8.     Perform one of the following tasks as required:

¡     If you have selected Export to one file, click OK in the dialog box that opens.

¡     If you have selected Export to files, specify the number of logs to be exported to each file and click OK in the dialog box that opens.

When a log export to one file is complete, a dialog box opens, asking you whether to continue exporting the remaining logs to a new file.

-     To continue the export, click Yes.

-     To stop the export process, click No.

Aggregate logs

Perform this task to enable log aggregation. Log aggregation reduces the log volume and facilitates you to view the logs. With log aggregation enabled, the device aggregates service logs that meet the same aggregation criteria at configured intervals. The log aggregation criteria include source IP address, destination IP address, application, source port, destination port, threat ID, threat name, and threat type.

Procedure

1.     Click the Monitor tab.

2.     In the navigation pane, select Security Logs > Threat Logs.

3.     Click Log aggregation settings.

4.     On the page that opens, select the check box next to Enable and configure the aggregation interval.

5.     Click OK.