Update content

umn/source/audit/index.rst

@@ -0,0 +1,16 @@
+:original_name: cfw_01_0148.html
+
+.. _cfw_01_0148:
+
+Audit
+=====
+
+-  :ref:`Operations Recorded by CTS <cfw_01_0149>`
+-  :ref:`Viewing Audit Logs <cfw_01_0150>`
+
+.. toctree::
+   :maxdepth: 1
+   :hidden: 
+
+   operations_recorded_by_cts
+   viewing_audit_logs

umn/source/audit/viewing_audit_logs.rst

@@ -0,0 +1,8 @@
+:original_name: cfw_01_0150.html
+
+.. _cfw_01_0150:
+
+Viewing Audit Logs
+==================
+
+After you enable CTS, the system starts recording operations on CFW. You can view the operation records of the last seven days on the CTS console.

umn/source/auditing_logs/index.rst

@@ -0,0 +1,16 @@
+:original_name: cfw_01_0012.html
+
+.. _cfw_01_0012:
+
+Auditing Logs
+=============
+
+-  :ref:`Querying Logs <cfw_01_0139>`
+-  :ref:`Log Management <cfw_01_0140>`
+
+.. toctree::
+   :maxdepth: 1
+   :hidden: 
+
+   querying_logs
+   log_management/index

umn/source/auditing_logs/log_management/adding_alarm_notifications.rst

@@ -0,0 +1,78 @@
+:original_name: cfw_01_0143.html
+
+.. _cfw_01_0143:
+
+Adding Alarm Notifications
+==========================
+
+You can create alarm rules to monitor logs in real time. When a log meets the preset rules, an alarm is generated and sent to you by SMS message or email. This function can be used to monitor exceptions in real time.
+
+Prerequisites
+-------------
+
+Logs have been dumped to LTS by configuring :ref:`Log Settings <cfw_01_0141>`.
+
+Procedure
+---------
+
+#. Log in to the management console.
+
+#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed.
+
+#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column to go to the details page.
+
+#. In the navigation pane on the left, choose **Log Audit** > **Log Management**.
+
+   Click **Create Alarm Rule** in the upper right corner. :ref:`Creating an alarm rule <cfw_01_0143__table812415339467>` describes the parameters for creating an alarm rule.
+
+   .. _cfw_01_0143__table812415339467:
+
+   .. table:: **Table 1** Parameters for creating an alarm rule
+
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Parameter               | Description                                                                                                                                                                                | Example Value         |
+      +=========================+============================================================================================================================================================================================+=======================+
+      | Rule Name               | Name of the alarm rule.                                                                                                                                                                    | test                  |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Description             | Rule description.                                                                                                                                                                          | ``-``                 |
+      |                         |                                                                                                                                                                                            |                       |
+      |                         | .. note::                                                                                                                                                                                  |                       |
+      |                         |                                                                                                                                                                                            |                       |
+      |                         |    Enter up to 64 characters.                                                                                                                                                              |                       |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Statistics              | Possible values are **By keyword** and **By SQL**.                                                                                                                                         | **By keyword**        |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Log Group Name          | Select a log group.                                                                                                                                                                        | ``-``                 |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Enterprise Project Name | Select an enterprise project.                                                                                                                                                              | ``-``                 |
+      |                         |                                                                                                                                                                                            |                       |
+      |                         | This parameter is displayed only when the enterprise project function is enabled for the current account.                                                                                  |                       |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Log Stream Name         | Select a log stream.                                                                                                                                                                       | ``-``                 |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Keywords                | Enter keywords that you want LTS to monitor in logs.                                                                                                                                       | \_time                |
+      |                         |                                                                                                                                                                                            |                       |
+      |                         | .. note::                                                                                                                                                                                  |                       |
+      |                         |                                                                                                                                                                                            |                       |
+      |                         |    -  Keywords cannot start with an asterisk (*) or question mark (?).                                                                                                                     |                       |
+      |                         |    -  Exact and fuzzy matches are supported. A keyword is case sensitive and contains up to 1024 characters.                                                                               |                       |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Query Time Range        | Time range for the keyword query, which is one period earlier than the current time.                                                                                                       | 1 h                   |
+      |                         |                                                                                                                                                                                            |                       |
+      |                         | -  The value ranges from 1 to 60 in the unit of minutes.                                                                                                                                   |                       |
+      |                         | -  The value ranges from 1 to 24 in the unit of hours.                                                                                                                                     |                       |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Query Frequency         | Sets the query frequency.                                                                                                                                                                  | **Hourly**            |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Matching Log Events     | When the number of log events that contain the configured keywords reaches the specified value, an alarm is triggered.                                                                     | >10                   |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Alarm Severity          | Possible values are **critical** (default), **major**, **minor**, and **info**.                                                                                                            | **critical**          |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | Send Notifications      | Possible values are **No** (default) and **Yes**.                                                                                                                                          | **No**                |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+      | SMN Topic               | If you select **Yes** for **Send Notifications**, you need to select a Simple Message Notification (SMN) topic, time zone, language, and message template. You can select multiple topics. | ``-``                 |
+      +-------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
+
+#. Confirm the information and click **OK**.
+
+.. |image1| image:: /_static/images/en-us_image_0000001259322747.png

umn/source/auditing_logs/log_management/changing_the_log_storage_duration.rst

@@ -0,0 +1,28 @@
+:original_name: cfw_01_0142.html
+
+.. _cfw_01_0142:
+
+Changing the Log Storage Duration
+=================================
+
+Logs are stored for seven days by default. The storage duration can be set to 1 to 360 days. Logs that exceed the storage duration will be automatically deleted. For log data that needs to be stored for a long time (log persistence), LTS can dump the logs to OBS for medium- and long-term storage.
+
+Prerequisites
+-------------
+
+Logs have been dumped to LTS by configuring :ref:`Log Settings <cfw_01_0141>`.
+
+Procedure
+---------
+
+#. Log in to the management console.
+#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed.
+#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column to go to the details page.
+#. In the navigation pane on the left, choose **Log Audit** > **Log Management**. On the displayed page, click **Modify Log Storage Duration**.
+
+   .. note::
+
+      -  Logs can be stored for 1 to 360 days. Logs that exceed the specified storage duration are automatically deleted.
+      -  The longer the storage duration, the larger the occupied storage. For details about how to dump logs to other cloud services for long-term storage, see .
+
+.. |image1| image:: /_static/images/en-us_image_0000001259322747.png

umn/source/auditing_logs/log_management/index.rst

@@ -0,0 +1,26 @@
+:original_name: cfw_01_0140.html
+
+.. _cfw_01_0140:
+
+Log Management
+==============
+
+-  :ref:`Log Settings <cfw_01_0141>`
+-  :ref:`Changing the Log Storage Duration <cfw_01_0142>`
+-  :ref:`Adding Alarm Notifications <cfw_01_0143>`
+-  :ref:`Log Structuring <cfw_01_0144>`
+-  :ref:`Visualization <cfw_01_0145>`
+-  :ref:`Quick Analysis <cfw_01_0146>`
+-  :ref:`Log Field Description <cfw_01_0147>`
+
+.. toctree::
+   :maxdepth: 1
+   :hidden: 
+
+   log_settings
+   changing_the_log_storage_duration
+   adding_alarm_notifications
+   log_structuring
+   visualization
+   quick_analysis
+   log_field_description

umn/source/auditing_logs/log_management/log_settings.rst

@@ -0,0 +1,47 @@
+:original_name: cfw_01_0141.html
+
+.. _cfw_01_0141:
+
+Log Settings
+============
+
+You can record attack event logs, access control logs, and traffic logs to Log Tank Service (LTS) and use these logs to quickly and efficiently perform real-time decision analysis, device O&M, and service trend analysis.
+
+LTS analyzes and processes a large number of logs. It enables you to process logs in real-time, efficiently, and securely.
+
+.. important::
+
+   -  On the **Log Query** page, you can check and export log data of the last seven days. For details, see :ref:`Querying Logs <cfw_01_0139>`.
+   -  If logs are recorded in LTS, you can view log data in the past 1 to 360 days. For details, see :ref:`Log Management <cfw_01_0140>`.
+   -  LTS is billed by traffic and is billed separately from WAF.
+
+Procedure
+---------
+
+#. Log in to the management console.
+#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed.
+#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column to go to the details page.
+#. In the navigation pane on the left, choose **Log Audit** > **Log Management**. The Log Management page is displayed. Toggle on |image2| to enable the cloud log interconnection service.
+#. Create log groups and log streams. For details, see **Log Tank Service > Getting Started > Step 1: Creating Log Groups and Log Streams**.
+
+   .. note::
+
+      To make it easier for you to view, you are advised to:
+
+      -  Add **-cfw** as the suffix when creating a log group.
+      -  When creating log streams, add the suffixes **-attack**, **-access**, and **-flow** to attack event logs, access control logs, and traffic logs.
+
+#. Select a created log group or log stream. Click **OK**.
+
+   .. note::
+
+      -  The formats of attack logs, access logs, and traffic logs are different. You need to configure different log streams for them.
+
+      -  Attack logs: record attack alarm information, including the attack event type, protection rule, protection action, quintuple, and attack payload.
+
+         Access logs: record information about the traffic that matches the ACL policy, including the matching time, quintuple, response action, and the matched access control rule.
+
+         Traffic logs: record information about all traffic passing through the CFW, including the start time, end time, quintuple, number of bytes, and number of packets.
+
+.. |image1| image:: /_static/images/en-us_image_0000001259322747.png
+.. |image2| image:: /_static/images/en-us_image_0000001349643997.png

umn/source/auditing_logs/log_management/log_structuring.rst

@@ -0,0 +1,42 @@
+:original_name: cfw_01_0144.html
+
+.. _cfw_01_0144:
+
+Log Structuring
+===============
+
+Log data can be structured or unstructured. Structured data is quantitative data or can be defined by unified data models. It has a fixed length and format. Unstructured data has no pre-defined data models and cannot be fit into two-dimensional tables of databases.
+
+During log structuring, logs with fixed or similar formats are extracted from a log stream based on your defined structuring method and irrelevant logs are filtered out. You can then use SQL syntax to query and analyze the structured logs.
+
+Prerequisites
+-------------
+
+Logs have been dumped to LTS by configuring :ref:`Log Settings <cfw_01_0141>`.
+
+Procedure
+---------
+
+#. Log in to the management console.
+#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed.
+#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column to go to the details page.
+#. In the navigation pane on the left, choose **Log Audit** > **Log Management**. Select the target log group and log stream.
+#. Click the **Visualization** tab and select **JSON**.
+#. Extract log fields.
+
+   a. Click **Step 1 Select a sample log event**, select a log event, or enter a log event in the text box, and click **OK**.
+
+      .. note::
+
+         Select a typical log.
+
+   b. Click **Intelligent Extraction** in **Step 2 Extract fields** to extract the log fields.
+
+      .. note::
+
+         -  The **float** data type has seven digit precision.
+         -  To have higher accuracy, you are advised to change the field type to **String** when the accuracy exceeds seven digits.
+
+#. Click **Save**. The type of extracted fields cannot be changed after the structuring is complete.
+
+.. |image1| image:: /_static/images/en-us_image_0000001259322747.png

umn/source/auditing_logs/log_management/quick_analysis.rst

@@ -0,0 +1,26 @@
+:original_name: cfw_01_0146.html
+
+.. _cfw_01_0146:
+
+Quick Analysis
+==============
+
+Quick analysis helps you collect and query log data. You can view statistics on logs by searching for specified fields.
+
+Prerequisites
+-------------
+
+Logs have been dumped to LTS by configuring :ref:`Log Settings <cfw_01_0141>`.
+
+Procedure
+---------
+
+#. Log in to the management console.
+#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed.
+#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column to go to the details page.
+#. In the navigation pane on the left, choose **Log Audit** > **Log Management**. Select the target log group and log stream.
+#. Click |image2| in the upper right corner of the page. On the **Index Settings** tab of the **Settings** page, add fields and enable quick analysis.
+#. Click **OK**. The quick analysis task is created.
+
+.. |image1| image:: /_static/images/en-us_image_0000001259322747.png
+.. |image2| image:: /_static/images/en-us_image_0000001623223858.png

umn/source/auditing_logs/log_management/visualization.rst

@@ -0,0 +1,79 @@
+:original_name: cfw_01_0145.html
+
+.. _cfw_01_0145:
+
+Visualization
+=============
+
+Visualization allows you to query and analyze structured log fields using SQL statements. After log structuring, wait about 1-2 minutes for SQL query and analysis.
+
+Prerequisites
+-------------
+
+-  Logs have been dumped to LTS by configuring :ref:`Log Settings <cfw_01_0141>`.
+-  Log structuring has been completed. For details, see :ref:`Log Structuring <cfw_01_0144>`.
+
+Procedure
+---------
+
+#. Log in to the management console.
+
+#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed.
+
+#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column to go to the details page.
+
+#. In the navigation pane on the left, choose **Log Audit** > **Log Management**. Select the target log group and log stream.
+
+#. Click the **Visualization** tab and select the chart type you want to use to display your query results.
+
+   Currently, five chart types are supported, as described in :ref:`Chart parameters <cfw_01_0145__table9968171023714>`.
+
+   .. _cfw_01_0145__table9968171023714:
+
+   .. table:: **Table 1** Chart parameters
+
+      +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+      | Chart Type                        | Description                                                                                                                                                                                                                                                                                                                                               |
+      +===================================+===========================================================================================================================================================================================================================================================================================================================================================+
+      | Table Chart                       | -  **Records per Page**: number of log events displayed per page. The value can be 10 (default), 20, 30, or 50.                                                                                                                                                                                                                                           |
+      |                                   | -  **Filtering**: After the filtering function is enabled, you can filter results the right of the table header. Currently, only single-column search is supported.                                                                                                                                                                                       |
+      |                                   | -  **Sorting**: After the sorting function is enabled, you can select the ascending or descending order on the table header.                                                                                                                                                                                                                              |
+      +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+      | Bar Chart                         | -  **X Axis**: Select a field from the drop-down list box as the X axis. Digits and strings are supported.                                                                                                                                                                                                                                                |
+      |                                   | -  **Y Axis**: Select a field from the drop-down list box as the Y axis. Only numeric data is supported.                                                                                                                                                                                                                                                  |
+      |                                   | -  **X Axis Title** and **Y Axis Title**: Set the titles for the X axis and Y axis.                                                                                                                                                                                                                                                                       |
+      |                                   | -  **Y Axis Range**: Set the minimum and maximum values for the Y axis.                                                                                                                                                                                                                                                                                   |
+      |                                   | -  **Max Shown Categories**: The value can be 20, 40, 50 (default), 80, and 100.                                                                                                                                                                                                                                                                          |
+      |                                   | -  **Show Labels**: Set this parameter based on your requirements.                                                                                                                                                                                                                                                                                        |
+      |                                   | -  **Stacked**: Set this parameter based on your requirements. If you enable it, labels cannot be shown.                                                                                                                                                                                                                                                  |
+      +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+      | Line Chart                        | -  **X Axis**: Select a field from the drop-down list box as the X axis. The value can be a number or a string.                                                                                                                                                                                                                                           |
+      |                                   | -  **Y Axis**: Select a field from the drop-down list box as the Y axis. Only numeric data is supported.                                                                                                                                                                                                                                                  |
+      |                                   | -  **X Axis Title** and **Y Axis Title**: Set the titles for the X axis and Y axis.                                                                                                                                                                                                                                                                       |
+      |                                   | -  **Y Axis Range**: Set the minimum and maximum values for the Y axis.                                                                                                                                                                                                                                                                                   |
+      |                                   | -  **Line**: Select **Curved** or **Straight**.                                                                                                                                                                                                                                                                                                           |
+      |                                   | -  **Show Data Markers**: Set this parameter based on your requirements.                                                                                                                                                                                                                                                                                  |
+      +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+      | Pie Chart                         | -  **Category**: Select a field from the drop-down list box as the category. Only strings are supported.                                                                                                                                                                                                                                                  |
+      |                                   |                                                                                                                                                                                                                                                                                                                                                           |
+      |                                   | -  **Value**: Select a field from the drop-down list box. Only numeric data is supported.                                                                                                                                                                                                                                                                 |
+      |                                   |                                                                                                                                                                                                                                                                                                                                                           |
+      |                                   | -  **Label Position**: Select **Inside** or **Outside**. This parameter can be set only after you enable **Show Labels**.                                                                                                                                                                                                                                 |
+      |                                   |                                                                                                                                                                                                                                                                                                                                                           |
+      |                                   | -  **Shown Categories**: The value can be 5, 10 (default), 20, 30, or 40.                                                                                                                                                                                                                                                                                 |
+      |                                   |                                                                                                                                                                                                                                                                                                                                                           |
+      |                                   |    For example, if there are 20 categories and you only want to show 10, the first 10 categories will be represented by 10 slices, and the rest are grouped as one slice labeled as **Others**.                                                                                                                                                           |
+      |                                   |                                                                                                                                                                                                                                                                                                                                                           |
+      |                                   | -  **Coxcomb Chart**: In a coxcomb chart, the radius of pie slices differs depending on the percentage of the data that the slices represent.                                                                                                                                                                                                             |
+      |                                   |                                                                                                                                                                                                                                                                                                                                                           |
+      |                                   | -  **Show Labels**: Set this parameter based on your requirements.                                                                                                                                                                                                                                                                                        |
+      +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+      | Number Chart                      | -  **Data Column**: Select a field as the data source. Numeric data is recommended. After you select a field, the first data in the field column is displayed in the chart.                                                                                                                                                                               |
+      |                                   | -  **Add Comparison Data**: Set this parameter based on your requirements.                                                                                                                                                                                                                                                                                |
+      |                                   | -  **Comparison Data**: Select a field as the source of the comparison data. Numeric data is recommended. After you select the absolute value of the comparison data, the difference between the absolute value and the values in the selected data column is displayed in the chart. Comparison data can be used only after the comparison value is set. |
+      |                                   | -  **Description**: You can add a description for numbers.                                                                                                                                                                                                                                                                                                |
+      |                                   | -  **Data Unit** and **Comparison Data Unit**: Set the units based on your requirements.                                                                                                                                                                                                                                                                  |
+      |                                   | -  **Advanced Settings**: You can set **Number Format**, **Data Text Size**, **Comparison Data Text Size**, and **Unit Text Size**.                                                                                                                                                                                                                       |
+      +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+
+.. |image1| image:: /_static/images/en-us_image_0000001259322747.png

umn/source/change_history.rst

@@ -0,0 +1,12 @@
+:original_name: cfw_01_0084.html
+
+.. _cfw_01_0084:
+
+Change History
+==============
+
+========== ===================================
+Date       Description
+========== ===================================
+2024-04-30 This is the first official release.
+========== ===================================