Cloud based logging service

Patent metadata

Field	Value
Publication number	US-2016065606-A1
Application number	US-201514938598-A
Country	US
Kind code	A1
Filing date	Nov 11, 2015
Priority date	Jun 5, 2013
Publication date	Mar 3, 2016
Grant date	—

Abstract

Methods and systems are provided for facilitating access to a cloud-based logging service. According to one embodiment, access to a cloud-based logging service is integrated within a network security appliance by automatically configuring access settings for the logging service and providing a basic level of service from the logging service by registering a user account for the security appliance with the logging service. A log is transparently created within the logging service by making use of the automatically configured access settings and treating the logging service as a logging device. A request is received by the security appliance from an administrator to access data associated with the log. Responsive thereto and without requiring separate registration of the administrator with the cloud-based logging service, the data is transparently received by the security appliance from the logging service and is presented via a graphical user interface (GUI) of the security appliance.

First claim

What is claimed is:

1 . A network security appliance comprising:
one or more processors; and one or more internal data storage devices operatively coupled to the one or more processors and having stored therein:
a cloud-based logging service settings module including instructions, which when executed by the one or more processors, facilitate accessibility to a cloud-based logging service by an administrator of the network security appliance via a graphical user interface (GUI) presented by the network security appliance by integrating and customizing the cloud-based logging service within the network security appliance, including registering a user account for the network security appliance with the cloud-based logging service;
a cloud-based logging service access module, providing a basic level of access to the cloud-based logging service without requiring separate registration of the administrator with the cloud-based logging service, the cloud-based logging service including instructions, which when executed by the one or more processors:
receive, via the GUI, a request to access the cloud-based logging service from the administrator;
responsive to the request, cause one or more logs created by the network security appliance containing information regarding events or traffic observed by the network security appliance within a network protected by the network security appliance to be retrieved from the cloud-based logging service; and

an output module, including instructions, which when executed by the one or more processors:
receive the retrieved one or more logs at the network security appliance; and
display the retrieved one or more logs to the administrator via the GUI.

2 . The network security appliance of claim 1 , wherein the cloud-based logging service is invoked by the network security appliance through an application programming interface (API) of the cloud-based logging service, wherein the API is implemented within the network security appliance.

3 . The network security appliance of claim 1 , wherein the network security appliance is configured to provide and measure an extent of security of the network against network threats, content threats and application-level threats.

4 . The network security appliance of claim 3 , wherein the network security appliance is in a form of one or more of a gateway, an application-level threat detector, a firewall, an Intrusion Prevention System (IPS), an application delivery controller, a Virtual Private Network (VPN) appliance and a web content filtering appliance.

5 . The network security appliance of claim 1 , wherein the cloud-based logging service settings module is configured to disable access to the cloud-based logging service by default.

6 . The network security appliance of claim 1 , wherein the cloud-based logging service settings module is configured to enable access to the cloud-based logging service by default.

7 . A method comprising:
integrating access to a cloud-based logging service within a network security appliance by automatically configuring access settings for the cloud-based logging service and providing a basic level of service from the cloud-based logging service by registering a user account for the network security appliance with the cloud-based logging service; transparently creating within the cloud-based logging service, by the network security appliance, a traffic log or an event log for a network in which the network security appliance resides by making use of the automatically configured access settings and treating the cloud-based logging service as a logging device; receiving, by the network security appliance, a request from an administrator of the network security appliance to access data associated with the traffic log or the event log; responsive to the request and without requiring separate registration of the administrator with the cloud-based logging service, transparently retrieving, by the network security appliance, the data from the cloud-based logging service and presenting the data to the administrator via a graphical user interface (GUI) of the network security appliance.

8 . The method of claim 7 , wherein the cloud-based logging service is invoked by the network security appliance via an application programming interface (API) of the cloud-based logging service, wherein the API is implemented within the network security appliance.

9 . The method of claim 7 , wherein the network security appliance is configured to provide and measure an extent of security of the network against network threats, content threats and application-level threats.

10 . The method of claim 9 , wherein the network security appliance comprises one or more of a gateway, an application-level threat detector, a firewall, an Intrusion Prevention System (IPS), an application delivery controller, a Virtual Private Network (VPN) appliance and a web content filtering appliance.

11 . The method of claim 7 , further comprising when the network security appliance does not have a local hard disk, enabling, by default, the cloud-based logging service for storage of the traffic log or the event log.

12 . The method of claim 11 , further comprising when the cloud-based logging service is enabled by default, prompting the administrator to register with the cloud-based logging service to obtain an enhanced level of services from the cloud-based logging service.

13 . The method claim 8 , further comprising when the network security appliance includes a local hard disk, disabling, by default, the cloud-based logging service for storage of the traffic log or the event log.

14 . A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network security appliance, cause the one or more processors to perform a method comprising:
facilitating access, by the network security appliance, to a basic level of service from a cloud-based logging service by (i) automatically configuring access settings associated with the cloud-based logging service to which access has been integrated within the network security appliance and (ii) registering a user account for the network security appliance with the cloud-based logging service; treating, by the network security appliance, the cloud-based logging service as a logging device by storing within a traffic log or an event log within the cloud-based logging service one or more of (i) information regarding observed traffic within a network in which the network security appliance resides and (ii) information regarding observed events within the network; receiving, by the network security appliance from an administrator of the network security appliance, a request to access data associated with the traffic log or the event log; and responsive to the request, transparently retrieving, by the network security appliance, the data from the cloud-based logging service and presenting the data to the administrator via a graphical user interface (GUI) of the network security appliance.

15 . The non-transitory computer-readable storage medium of claim 14 , wherein the cloud-based logging service is invoked by the network security appliance via an application programming interface (API) of the cloud-based logging service, wherein the API is implemented within the network security appliance.

16 . The non-transitory computer-readable storage medium of claim 14 , wherein the network security appliance is configured to provide and measure an extent of security of the network against one or more of network threats

Assignees

• Fortinet Inc

Inventors

• Yin Jun

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title