Fortinet 177 FortiWeb 5.0 Patch 6 Administration Guide
5. In Server Type, enable one or more of the predefined, web server-specific suspicious URL
sets that you want to detect.
To view detailed descriptions of the types of patterns that each suspicious URL type will
detect, see “Predefined suspicious request URLs” on page 172.
6. From the Custom Suspicious Policy drop-down list, select a group of custom suspicious
URLs, that you have configured, if any.
7. Click OK.
8. To use a suspicious URL pattern, select it when configuring an auto-learning profile (see
“Configuring an auto-learning profile” on page 177).
See also
•Predefined suspicious request URLs
•Grouping custom suspicious request URLs
•Configuring an auto-learning profile
•Recognizing suspicious requests
Configuring an auto-learning profile
Auto-learning profiles are selected in a server policy in conjunction with an inline or offline
protection profile. Auto-learning profiles gather data for the auto-learning report from any
attacks and parameters that are detected.
The predefined auto-learning profile, named Default Auto Learn Profile, cannot be edited or
deleted. If you do not want to configure your own auto-learning profile, or are not sure how to,
you can use this profile. Alternatively, you can use it as a starting point: clone it, modify the
clone, then select the clone in a server policy.
Default Auto Learn Profile assumes that you want to learn about all parameters, and allow web
crawlers from the search engines Google, Yahoo!, Baidu, and MSN/Bing.
Default Auto Learn Profile uses a predefined data type group, a predefined suspicious URL
pattern, and other settings which are required to guarantee a complete data set for an
auto-learning report. The default profile also does not use attack signatures that could cause
false positives.
To configure an auto-learning profile
If you know that your network’ does not rely on one or more of the listed web server types,
disable scans for suspicious access to their administrative URLs in order to improve
performance.
If you have already gathered some auto-learning data and want to refine it more quickly, you
can generate a new auto-learning profile from auto-learning reports, then continue with an
additional phase of auto-learning. For details, see “Generating a profile from auto-learning
data” on page 196.