Managing referrer logs

FortiRecon analyzes web referrer logs to identify potential phishing attacks. Web referrer logs provide valuable insights into the links that direct traffic to your website. In a typical phishing attack, threat actors redirect victims to the legitimate site after capturing sensitive information. By analyzing these logs, FortiRecon can detect suspicious referrer patterns indicative of phishing activity.

To enable this analysis, you must configure a periodic cron job to upload your web referrer logs to FortiRecon via Amazon Web Services Command Line Interface (AWS CLI).

Before uploading log files, ensure that AWS CLI is installed and configured on the server where the logs are stored. Perform the following steps to setup referrer logs.

1. Create AWS Bucket. You need to create a new S3 bucket once, for the initial setup.

   1. In FortiRecon, navigate to Brand Protection > Domain Threats > Manage Referrer Logs.

   2. Click Create a Bucket.

   3. Upon successful bucket creation, the necessary access information will be shared with you via email.

      

2. Download and Install AWS CLI. Install AWS CLI on your system using the appropriate commands for your operating system:

   • Windows: Download the installer from the AWS CLI Installation page.

   • macOS: Run the command brew install awscli in your terminal.

   • Linux: Run the following command in your terminal.

     • For Debian-based systems, run the command sudo apt-get install awscli.

     • For Red Hat-based systems, execute the command sudo yum install aws-cli.

3. Configure AWS CLI. After installing AWS CLI, configure it with your AWS access key and secret key shared via email.

   1. Open your terminal or command prompt.

   2. Run the command aws configure.

   3. Enter your credentials when prompted.

      • AWS Access Key ID: Enter your access key.

      • AWS Secret Access Key: Enter your secret key.

      • Default region name: Enter your preferred AWS region (e.g., us-east-1).

      • Default output format: Press Enter to accept the default (usually json).

4. Upload Log Files. Upload your log files to the designated S3 bucket using the following command.

   aws s3 cp /path/to/local/file s3://your-bucket-name/

   Replace /path/to/local/file with the actual path to your log file.

   Replace your-bucket-name with the name of your S3 bucket.

   Example: aws s3 cp /home/user/documents/apache.log s3://cddf82s42-22sced-e6nws4c436-referal-logs-testing/Co531lMJyOQXBJI9741ifVwgNPSGaNCJ1F0qqGlUNECTHbfMHiBvbg5tnsoJRAw3/

Only valid log files in .log or .zip format will be processed. Uploaded files are processed within a few hours. Files are automatically deleted after 7 days. FortiRecon currently supports Apache and Nginx web server logs. If you use a different web server, open a support ticket to request support.