So you have your firewall in place and all is working great. You are collecting logs on everything that you need to keep an eye on. But then the problems start. You know something unexpected is happening in the network but what is it? You can look through all that data trying to find the problem, but this can become quite tedious and analogous to looking for the proverbial needle in a haystack.

This is where a picture can greatly help; a chart to be specific. A chart can help for continuous monitoring and alert you to abnormal data patterns at a glance. Also the ability to generate specific charts when trying to find a problem can significantly reduce the time to hunt through a log.

Besides hunting down problems, using charts for reports is very useful for seeing historical trends and patterns which would be difficult to see in the data alone.

What’s In The Box

FortiOS 4.0 MR2 introduces new reporting capabilities, similar to the FortiAnalyzer product family. Users will be able to create charts from their local FortiGate logs for specific reports as well as dashboard monitoring. This powerful reporting system is highly customizable, allowing the user to create their own chart layouts with custom logos. Following is a list of some of the new features available in this new reporting system.

• Customizable page layout.
• Reports can support multiple columns
• Individual fonts, coloring and size for titles, sub titles, headings and more.
• Ability to embed graphics throughout the report
• Large selection of pre-configured charts. Just add one to a report with a few easy mouse clicks.
• Fully customized charts can be created using SQL queries of the log data.
• Frequently used charts can be added to the favorites list for quick and easy access.
• Output the report in multiple formats such as PDF and HTML.
• Schedule the generation time of any report. Useful for running reports in off peak hours and periodic daily, weekly or monthly reports.

Charts and Reports

There will be several types of charts to use when graphing log data such as Pie, Bar, Line and Area charts. Users can create their own custom reports and choose from many of the built-in default charts.

To create a new report the following steps can be followed.

Enabling Report Configuration

1. Login to your FortiGate and go to the Log & Report menu item. If you are using vdoms, choose the appropriate vdom at the bottom of the menu first.
2. Navigate to Log Config->Log Setting.
3. Enable “Local Logging & Archiving” and enable logging to “Disk”.
4. Enable any or all of the SQL Logging options. For example AntiVirus Log.
5. Choose apply, then refresh your browser.

Create the Report

1. Navigate again to the Log & Report menu and you will now see a new section called “Report Config”

2. Expand “Report Config” and choose “Layout”

3. Click the “Create New” button in the title bar.

4. Give your report a name, description and you may choose a theme (new themes may be created in the “Theme” section)

5. Choose an output format and schedule.

6. Set a report title and subtitle as necessary.

7. Enable any other options as you like, such as “Table of Contents”, “HTML Navigation Bar” etc.

Adding Charts and Other Items

1. Click the Add button in the “Report Components” section

2. In the dialog that appears, choose from one of the component types (e.g. text, chart, image, misc)

3. Then choose an item from the available components.

4. When adding charts you will have the option of filtering by chart category and favorites to quickly choose from default and/or custom made charts.

5. Choose the OK button to add the component.

6. Repeat these steps to add more Report components.

7. You may edit or delete any of the components.

8. When satisfied with the layout choose the OK button to save the new report.

Running the Report

1. If the report is scheduled the report will run at the scheduled time.
2. To run the report immediately go to Report Config->Layout and enable one or more reports to run.
3. Choose the Run button on the title bar.
4. It may take a bit of time to run.
5. Navigate to Report Access->Disk and view the report by clicking the “Report File” name or a link in the “Other Formats” column.

In the next section I’ll discuss an advanced method for getting exactly the type of chart you want to see in your reports.

Advanced Charting

Custom charts can be built using direct SQL queries of the log data. For example, the following steps can be used to create a custom chart for showing the latest virus events over the past 48 hours instead of the default 24 hours.

Create the Dataset

1. Login using the terminal, either directly with a third party application or via the gui console widget.
2. Be sure to enter the appropriate vdom if using vdoms, for example to enter the root vdom.

config vdom
edit root

1. Create custom dataset using the following cli commands

config report dataset
    edit "latest-virus-last48h"
        set query "select virus, timestamp, src, sport, dst, dport,
        service, filetype, filefilter, status, msg from antivirus_log
        where timestamp >= F_TIMESTAMP(\'now\',\'hour\',\'-47\')
           order by timestamp desc limit 100"
    end
end

1. Navigate to Log&Report->Report Config->Chart on the web based gui
2. Click the “Create New” button in the title bar
3. Enter a name for the chart.
4. Find the new data set “latest-virus-last48h” in the dataset drop list.
5. Add any comments and choose a graph type.
6. Choose the appropriate X and Y databindings (e.g. timestamp and virus respectively)
7. Setup scale information
8. Click the OK button.

Now your chart is ready for use as described previously in creating a report above.

Conclusion

The new log reporting feature for FortiOS 4.0 MR2 is a powerful tool to help visualize what is happening in your network. I hope you enjoyed this article and this new feature will become a much used tool in your security toolbox.

When it comes to antivirus, how much coverage do you need? Everyone has different concerns when it comes to antivirus coverage. Some people want to circle the wagons and let very little into their networks, while others need some basic protection but prefer speed, speed and more speed. In this article I’ll discuss the new antivirus features in the FortiOS 4.0 MR2 for the FortiGate family and how your device can be configured for your preferred level of coverage versus performance.

Malware Lifecycles

All malware have a life cycle. Some are like shooting stars, blasting across the Internet infecting everything in their path and going out with a bang with the next signature update, leaving much news buzz in their wake. Others creep along, slowly infiltrating systems with their variants, keeping their name alive for months to years. Still others have gone the way of the dinosaurs and only live in memory, no longer spreading or able to spread on modern operating systems, aka the zoo viruses. In general it is the actively spreading viruses that a user need be overly concerned about and use products providing coverage for these active malware.

Today viruses are still tracked using the Wild List, a vendor independent managed list of the most active viruses. This is used as a minimal benchmark for vendors, to ensure that customers are protected from the most actively reported threats. The viruses that slow down and eventually drop off of this list eventually find themselves on the list of zoo viruses and are rarely, if ever, seen in the wild again.

Under the Hood

Although there are many different vendors of antivirus products most vendors use very similar techniques and need to deal with the same issues when trying to detect a virus. Most viruses are contained in a file of some sort, either self executable or as part of a format where it can be executed by another host program (e.g. such as a macro virus embedded in a document). Roughly 80-85 percent of the effort when examining a file is decomposing the file into a usable form for signature scanning. Decomposing the file is the process of extracting or converting the data of that file to a form where the signature scanning routines can match any known viruses in its corresponding database. For example, an incoming file may be an archive file, such as a zip archive, containing an executable file. If the file is sent in an email it is often in an ASCII format called base64. The file needs to be converted back to binary for deeper examination. This in-depth decomposition of the file is very often required for the most sophisticated viruses and therefore the full file needs to be buffered.

Flow or stream based antivirus is one of the latest techniques being used by network based products for scanning. They have a high throughput and use state based engines to keep track of what they have scanned, but they do have some limitations that probably can’t be solved due to the format of certain types of files. For example, some archive formats can not be streamed due to complexities in parts of their algorithms so streaming scanners have difficulty with these files. Heavily encrypted files, packed executables and file infectors may be difficult to detect using these stream based methods since not all the data will be available to assist in decryption of the files. Viruses embedded in documents require more in-depth extraction routines which are probably not commonly used in stream based scanning. Some files, such as polymorphic or packed files, require emulation in order to extract the clear viral code from its encrypted cocoon. Without this level of decomposition the number of different detection signatures that would be required is staggering to imagine. It’s not all bad news however. Flow or stream based methods are quite effective and fast against certain types of malware such as static worms (executables that don’t change their binary composition when they spread), certain Trojans, spyware, adware and other more static malware. Stream methods are useful for large files too, having little file size limits, but if you consider most malware files are relatively small (so they can spread quickly) the only advantage would be on large archives of files (which are most likely manually created and infrequently spread).

What Do You Need?

In this part of the article I’ll discuss the different coverage needs and how you can configure the latest FortiGate products to provide the appropriate level of protection and coverage. First I’ll discuss some of the different users and their basic needs.

• The Need For Speed: Some users are not overly concerned about full coverage for every virus that ever existed. They just want the Internet as fast as they can get it. For these users basic protection against most malware that is actively spreading is normally sufficient. Many of these users will also use host based antivirus if they want more protection at the host but still keep high speed networking (e.g. ISPs need to provide certain levels of performance so they may augment protection with host based security bundles for their customers). I’ll call these “High Performance” Users.
• On the Fence: Users in this category desire a bit more coverage but decent performance too. The malware coverage will go further back in history to malware that has lived over about the last year or so, but not go as far back as the ancient viruses of the 70s and 80s. I’ll call these “Cautious” Users.
• Nothing is Getting In: These users don’t want any viruses, no matter how old, in their networks. These users may be willing to sacrifice a bit of performance for full detection of every malware that has ever existed. I’ll call these users “Guarded” Users.

First Things First, What’s in the Box?

In the next version of the FortiGate OS 4.2 there will be support (on some platforms) for larger antivirus databases and a new stream based antivirus scanning engine. The breakdown of the basic coverage types are a follows:

• Normal
  • This setting contains signatures for the most currently active threats. These threats are actively spreading on the Internet in some form or another, e.g.) via email, self spreading worms, etc.
• Extended
  • This setting extends the Normal setting to include signatures for recent but no longer active malware. Such as viruses that may have been actively spreading within the past year but have significantly or completely died off.
• Extreme
  • The extreme setting provides the largest coverage and includes coverage of nearly all malware detected by Fortinet including zoo viruses from ages past.
• Flow
  • The flow antivirus operates independently from the above settings and is used as an alternative to the proxy based antivirus settings (normal, extended and extreme). It is a stream based scanning method in which the network session is inspected in chunks. Although fast, there are limitations with stream based scanning technology such that not all files can be fully decomposed in order to properly scan for a virus. Flow based scanning is however very fast and effective against static threats such as worms, Trojans, spyware and related malware. The flow based antivirus will cover a subsection of what the extreme setting detects.

These settings can be enabled on a per VDOM basis and used for all antivirus protection profiles within that VDOM. As a side note, users can override a specific protection profile setting using the CLI if desired.

High Performance Users

For High performance users there is the option of using the Flow AV option, a stream based scanning engine, or the proxy based normal setting. This can be set per VDOM via the CLI or GUI. Navigate to the UTM menu and select the Antivirus->Virus Database menu item. On this page you will be able to configure your database settings that will be used by default by the antivirus protection profiles.

The normal antivirus database, containing detection for the most active threats, is available on all FortiGate models. Flow AV will only be available on certain newer models such as the FGT-80C, and other mid/high end models.

Cautious Users

For cautious users it is recommended to use the Extended setting. This provides coverage for both older threats, up to about one year, as well as any malware that is actively spreading. Older threats were previously active malware that have essentially died off and are no longer being reported to our servers. Although some of these threats continue to spread in small areas, they are no longer widespread.

The extended database is available on many of the newer mid to high end FortiGate Products.

Guarded Users

For guarded users the extreme setting is the way to go. This gives the largest coverage to prevent both the newest threats from entering the network as well as preventing users from downloading some old archives of legacy malware. Users also have the option of enabling the full grayware detection to scan for programs that may not necessarily be threatening but cause annoyance, such as adware.

The extreme database will be available on many of the newer mid to high end FortiGate Products.

Conclusion

When looking for a product to protect your network, be wary of what various products are offering. You may be looking for speed, but know the benefits and limitations of the different types of technologies so you can choose what is best for your network. Although the data sheet may look impressive in regards to performance numbers, ask what kind of coverage you are really getting. At least ensure that you can get coverage for the Wild List and other active threats with whatever product you choose. I hope this article helps you decide the type of coverage you require in your network and what products suit your needs. May your networks remain infection free.