Technical Tip: Alert logging for DOS Anomalies

[nradia_FTNT]

Description	This article describes how to get email alerts for DOS Anomalies.
Scope	FortiGate 5.X, 6.X and 7.X.
Solution	Currently, the feature to send alert emails for Anomalies does not exist under Automation stitches. It is possible to do packet logging via CLI, explained in this article: Technical Tip: Information about Count field in anomaly log.  The following article explains logging for DOS attacks: Technical Tip: DoS attack log according to action set on DoS policy.     The following article shows how to display them using FortiAnalyzer: Technical Note: Anomaly logs are not showing up in FortiAnalyzer. FortiGate-81F # config firewall DoS-policy FortiGate-81F (DoS-policy) # edit 1 new entry '1' added FortiGate-81F (1) # set name "DOS Logging" FortiGate-81F (1) # set interface internal1 FortiGate-81F (1) # set srcaddr all FortiGate-81F (1) # set dstaddr all FortiGate-81F (1) # set service ALL FortiGate-81F (1) # config anomaly FortiGate-81F (anomaly) # edit "icmp_src_session" FortiGate-81F (icmp_src_session) # set status enable FortiGate-81F (icmp_src_session) # set log enable FortiGate-81F (icmp_src_session) # set action block FortiGate-81F (icmp_src_session) # set threshold 3 FortiGate-81F (icmp_src_session) # next FortiGate-81F (anomaly) # end Related Forum post example: Anomaly Email Alert.