222 Fortinet Inc.
Logging attacks Network Intrusion Detection System (NIDS)
To set Prevention signature threshold values
1Go to NIDS > Prevention.
2Select Modify beside the signature for which you want to set the Threshold value.
Signatures that do not have threshold values do not have Modify icons.
3Type the Threshold value.
4Select the Enable check box.
5Select OK.
Logging attacks
Whenever the NIDS detects or prevents an attack, it generates an attack message.
You can configure the system to add the message to the attack log.
•Logging attack messages to the attack log
•Reducing the number of NIDS attack log and email messages

Logging attack messages to the attack log

To log attack messages to the attack log
1Go to Log&Report > Log Setting.
2Select Config Policy for the log locations you have set.
3Select Attack Log.
4Select Attack Detection and Attack Prevention.
5Select OK.

Reducing the number of NIDS attack log and email messages

Intrusion attempts might generate an excessive number of attack messages. Based
on the frequency that messages are generated, the FortiGate unit automatically
deletes duplicates. If you still receive an excessive number of unnecessary
messages, you can manually disable message generation for unneeded signature
groups.

Automatic message reduction

The attack log and alert email messages that the NIDS produces include the ID
number and name of the attack that generated the message. The attack ID number
and name in the message are identical to the ID number and rule name that appear
on the NIDS Signature Group Members list.
Note: For information about log message content and formats, and about log locations, see the
FortiGate Logging and Message Reference Guide.