Configure a Botnet Report
You can schedule a botnet report or run it on demand. The firewall generates scheduled botnet reports every 24 hours because behavior-based detection requires correlating traffic across multiple logs over that timeframe.
- Define the types of traffic that indicate possible
- Select MonitorBotnet and click Configuration on the right side of the page.
- Enable and define the Count for
each type of HTTP Traffic that the report will include.The Count values represent the minimum number of events of each traffic type that must occur for the report to list the associated host with a higher confidence score (higher likelihood of botnet infection). If the number of events is less than the Count, the report will display a lower confidence score or (for certain traffic types) won’t display an entry for the host. For example, if you set the Count to three for Malware URL visit, then hosts that visit three or more known malware URLs will have higher scores than hosts that visit less than three. For details, see Interpret Botnet Report Output.
- Define the thresholds that determine whether the report will include hosts associated with traffic involving Unknown TCP or Unknown UDP applications.
- Select the IRC check box to include traffic involving IRC servers.
- Click OK to save the report configuration.
- Schedule the report or run it on demand.
- Click Report Setting on the right side of the page.
- Select a time interval for the report in the Test Run Time Frame drop-down.
- Select the No. of Rows to include in the report.
- (Optional)Add queries
to the Query Builder to filter the report output by attributes such
as source/destination IP addresses, users, or zones.For example, if you know in advance that traffic initiated from the IP address 10.3.3.15 contains no potential botnet activity, add not (addr.src in 10.0.1.35) as a query to exclude that host from the report output. For details, see Interpret Botnet Report Output.
- Select Scheduled to run the report daily or click Run Now to run the report immediately.
- Click OK and Commit.
Configuring the Botnet Report
Botnet Configuration Settings Monitor > Botnet > Configuration To specify the types of traffic that indicate potential botnet activity, click Configuration on the right side ...
Monitor > Botnet
Monitor > Botnet The botnet report enables you to use behavior-based mechanisms to identify potential malware- and botnet-infected hosts in your network. The report assigns ...
Interpret Botnet Report Output
Interpret Botnet Report Output The botnet report displays a line for each host that is associated with traffic you defined as suspicious when configuring the ...
Managing Botnet Reports
Botnet Report Settings Monitor > Botnet > Report Setting Before generating the botnet report, you must specify the types of traffic that indicate potential botnet ...
Generate Botnet Reports
Generate Botnet Reports The botnet report enables you to use heuristic and behavior-based mechanisms to identify potential malware- or botnet-infected hosts in your network. To ...
Report Types The firewall includes predefined reports that you can use as-is, or you can build custom reports that meet your needs for specific data ...
Generate Custom Reports
Generate Custom Reports You can configure custom reports that the firewall generates immediately (on demand) or on schedule (each night). To understand the selections available ...
View and Manage Reports
View and Manage Reports The reporting capabilities on the firewall allow you to keep a pulse on your network, validate your policies, and focus your ...
Identify Infected Hosts
Identify Infected Hosts After you have configured DNS sinkholing and verified that traffic to a malicious domain goes to the sinkhole address, you should regularly ...