How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise network for my project, so for starters i was looking on how are logs generated.

P.S.: what else do i need to mention to help my cause?

Edit-1: There is already a firewall device which has inbuilt IDS.The device is fortigate fg-800c which has inbuilt IDS and IPs capabilities.

  • 1
    That is totally vendor specific, any vendor can make its own decisions. There's no generic rule. So unless you can be specific on which vendor you're asking about, it's impossible to answer this question. – Teun Vink Jul 2 '18 at 7:08
  • 3
    In addition to this: most anomaly detection is not done by log analysis, which is way to inefficient. It's mostly done by live traffic inspection, either by putting an IDS in the forwarding path, or by attaching an IDS to a mirrorport on which all traffic is duplicated. – Teun Vink Jul 2 '18 at 7:09
  • @TeunVink we already have an IDS in place The device is fortigate fg-800c which has inbuilt IDS and IPs capabilities The goal of my project is finding anomaly which is not getting detected because of mis-configuration if there is any. – Harsh Sharma Jul 2 '18 at 8:38