Skip to main content
Boris_Tolshew
Boris_Tolshew
New Member
February 2, 2024
Solved

Customization of FortiWeb Web Vulnerability Scan reports

  • February 2, 2024
  • 2 replies
  • 1493 views

Does anyone ever use Web Vulnerability Scan in FortiWeb? Generated repoerts looks pretty poor (user friedly about 0%). How I can customize it? For example: one of the reports has about 8000 pages and it's not good at all (test report with test web-server). It is include full html http-response, but sometimes (in some vulnerabilities or suspected vulnerabilities) i don't need it at all. Can anyone help with it? Maybe in future versions of FortiWeb reports customiztion will be improved.

I can't do anything except write a some script that will be parse report and delete extra data, but this doesn't seem like a good solution.

Best answer by AEK

As scan template try select Fast Scan or OWASP Top 10 instead of Full Audit. This should make your report lighter.

On the other hand as far as I remember this report is mainly intended to be used to feed the custom Web Protection Profile that are based on vulnerability scan report, that's why they are not so user friendly.

So I think your method to use script to retain only useful data is good, otherwise you may need to use another scanner.

2 replies

aidenso
aidenso
New Member
February 2, 2024

I think there is also the fact that other vendor firewalls apply nextgen firewall features to the local in traffic, whereas fortigates don't unless you configure a custom local in policy with virtual patch enabled. These vulnerabilities on other firewalls can be remediated through the regular security feeds and don't require you to install a patch (usually) https://tutuapp.uno/ .

AEK
SuperUser
AEKAnswer
SuperUser
February 2, 2024

As scan template try select Fast Scan or OWASP Top 10 instead of Full Audit. This should make your report lighter.

On the other hand as far as I remember this report is mainly intended to be used to feed the custom Web Protection Profile that are based on vulnerability scan report, that's why they are not so user friendly.

So I think your method to use script to retain only useful data is good, otherwise you may need to use another scanner.

AEK
Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.