Troubleshooting Tip: Fixing empty data on FortiWeb Cloud Threat Analytics Dashboard

Threat Analytics uses machine learning algorithms to identify attack patterns across application assets, aggregate them into security incidents, and assign severity. This feature separates real threats from informational alerts and false positives to prioritise critical threats.

The FortiWeb Threat Analytics dashboard is accessible at https://appsec.fortinet.com/. Use the credentials associated with the registered FortiWeb licenses to log in.

Steps to verify configuration:

1. Verify that the Threat Analytics license is valid on FortiWeb under Dashboard -> Status -> Licenses widget.
2. From Dashboard -> Status -> System Information, enable Threat Analytics and select OK in the pop-up window.
3. Enable Attack Log under Log & Report -> Log Config -> Other Log Settings.
4. Verify the Threat Analytics status under the Threat Analytics widget. Ensure the status is Connected, and Attack Log Forwarding is set to Allow.

The Threat Analytics Dashboard should begin populating data.

Network Connectivity:

If data remains unpopulated after performing the steps above, ensure the following FQDN/Ports are reachable from FortiWeb:

b-1-public.produseast1mskcluster.vbr44g.c24.kafka.us-east-1.amazonaws.com:9194
b-2-public.produseast1mskcluster.vbr44g.c24.kafka.us-east-1.amazonaws.com:9194
b-3-public.produseast1mskcluster.vbr44g.c24.kafka.us-east-1.amazonaws.com:9194
b-1-public.prodeucentral1mskcl.nxsovf.c5.kafka.eu-central-1.amazonaws.com:9194
b-2-public.prodeucentral1mskcl.nxsovf.c5.kafka.eu-central-1.amazonaws.com:9194
b-3-public.prodeucentral1mskcl.nxsovf.c5.kafka.eu-central-1.amazonaws.com:9194

Debugging:

If the issue persists, collect the following debug logs and attach the outputs in a FortiWeb support ticket at the Fortinet Support portal :

     diagnose system threat-analytics info
   diagnose debug application wassd 7
   diagnose debug application sslutil 7

diagnose debug application logd 7

diagnose debug enable

Capture the logs for 3-4 minutes. Use the following command to stop the debug:

diagnose debug disable

Related article:

Analyzing attack logs in FortiWeb Cloud Threat Analytics 
Troubleshooting Tip: FortiWeb is not send the attack logs to Threat Analytics on FortiAppSec