WatchGuard Firebox System 7.0 User Guide

Chapter 12: Setting Up Logging and NotificationLogging and notification are crucial to an effective networksecurity policy. Together, they make it possible to monitoryour network security, identify both attacks and attackers,and take action to address security threats and challenges.WatchGuard logging and notification features are bothflexible and powerful. You can configure your firewall tolog and notify a wide variety of events, including specificevents that occur at the level of individual services. Formore information on logging, see the following collectionof FAQs:https://support.watchguard.com/advancedfaqs/log_main.aspDeveloping Logging and Notification PoliciesWhen creating a logging policy, you spell out what getslogged and when an event or series of events warrantssending out a notification to the on-duty administrator.Developing these policies simplifies the setup of individualservices in the WatchGuard Firebox System. If you havefully mapped out a policy, you can more easily delegateconfiguration duties and ensure that individual efforts donot contradict the overall security stance or logging andnotification policies.Logging policySpecifically, the logging policy delineates:• Which events to log• Which service events to log• Which servers are allocated as log hosts• How large a log file is allowed to become and howoften a new log file is createdIn general, you want to log only the events that might indicatea potential security threat, and ignore events thatwould waste bandwidth and server storage space. Thisgenerally translates into logging spoofs, IP options, probes,200 WatchGuard Firebox System