Fortinet FortiDDoS Cloud Monitoring

Key Features

• Packet Inspection Technology Granular Packet Inspection Stateful Monitoring Continuous Adaptive Rate Limiting Heuristic Analysis Predictive Behavioral Analysis Behavior Threshold Management System Recommendation based on past traffic statistics Adaptive threshold estimation Multi-verification Process Dynamic Filtering Active Verification Anomaly Recognition Protocol Analysis Rate Limiting White List, Black List, Non-Tracked Subnets State Anomaly Recognition Stealth Attack Filtering Dark Address Scan Prevention Source Tracking Legitimate IP Address Matching (Anti-Spoofing) Management SSL Management GUI CLI RESTful API Reporting Statistics Filterable Attack Log Over 80 built-in reporting graphs for each protected subnet and for each traffic direction Summary Graphs and Logs for: – Top Attacks – Top Attackers – Top ACL Drops – Top Attacked Subnets and IP Addresses – Top Attacked Protocols – Top Attacked TCP and UDP Ports – Top Attacked ICMP Types/Codes – Top Attacked URLs – Top Attacked HTTP Hosts, Referers, Cookies, User-Agents – Top Attacked DNS Servers – Top Attacked DNS Anomalies Centralized Event Reporting SNMP Email/Pager RESTful API Support for FortiAnalyzer, MRTG, Cacti Audit and Access Trails Login Audit Trail Configuration Audit Trail: Elevated treatment for Proxy-IPs — detected based on headers and number of concurrent connections Layer 3 Flood Mitigation Layer 3 Flood Mitigation Protocol Floods (all) Fragment Floods Source Floods Destination Floods Local Address Anti-Spoofing ((BCP38) Geo-location Access Control Policy (ACP) IP Reputation Layer 4 Flood Mitigation TCP Ports (all) UDP Ports (all) ICMP Type/Codes (all) Connection Flood SYN, ACK, RST, FIN Floods Excessive SYN/ACK/ESTAB/FIN/RST’s/ second per Source or Destination Zombie Floods Excessive Connections per Source Flood Excessive Connections per Destination Flood TCP State Violation Floods

Technical Specifications