# US 9,521,159 B2 · Cloud based logging service

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,521,159 B2
- Document ID: US9521159B2
- Status: Granted
- Kind: B2
- Application number: 15/066,632
- Filed: 2016-03-10
- Published: 2016-06-30
- Granted: 2016-12-13
- Earliest claimed: 2013-06-05
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Jun Yin
- Web page: https://patentgrep.com/patent/US9521159B2

## CPC

- H04L 63/0281: {Proxies}
- G06F 11/1471: involving logging of persistent data for recovery
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 63/02: {for separating internal from external traffic, e.g. firewalls}
- H04L 63/0254: {Stateful filtering}
- H04L 63/0272: {Virtual private networks}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and systems are provided for facilitating access to a cloud-based logging service. According to one embodiment, access to a cloud-based logging service is integrated within a network security appliance by automatically configuring access settings for the logging service and creating an account for the security appliance with the logging service. A log is created within the logging service by making use of the automatically configured access settings and the account. A request is received by the security appliance to access data associated with the log. Responsive thereto and without requiring separate registration with the cloud-based logging service, the data is retrieved by the security appliance from the logging service and is presented via an interface of the security appliance.

## Claims

### Claim 1

A system for managing access to a cloud-based logging service through a network security gateway appliance comprising:
one or more mircoprocessors; and
one or more internal data storage devices operatively coupled to the one or more microprocessors and storing:
a cloud-based logging service settings module configured to make the cloud-based logging service accessible to the network security gateway appliance via an interface of the network security gateway appliance by integrating the cloud-based logging service within the network security gateway appliance, the integrating including creating an account within the cloud-based logging service by registering the network security gateway appliance itself as a user of the cloud-based logging service in order to allow the network security gateway appliance access to the cloud-based logging service;
a cloud-based logging service access module configured to receive, via the interface, a request to access the cloud-based logging service, wherein the cloud-based logging service access module is further configured to analyze the request and retrieve logs from the cloud-based logging service for processing, wherein registration of the network security gateway appliance with the cloud-based logging service allows an administrator of the network security gateway appliance to access the cloud-based logging service via the interface without separately registering with the cloud-based logging service; and
an output module configured to receive processed logs at the network security gateway appliance and output the processed logs by the output module.

### Claim 2 (depends on 1)

The system of claim 1, wherein the cloud-based logging service is invoked by the network security gateway appliance through an application programming interface (API) of the cloud-based logging service, wherein the API is implemented within the network security gateway appliance.

### Claim 3 (depends on 1)

The system of claim 1, wherein the network security gateway appliance is configured to provide and measure an extent of security of a network against network threats, content threats and application-level threats.

### Claim 4 (depends on 3)

The system of claim 3, wherein the network security gateway appliance comprises one or more of a gateway, a network security appliance, an application-level threat detector, a firewall, an Intrusion Prevention System (IPS), an application control, a Virtual Private Network (VPN) appliance, and a web content filtering appliance.

### Claim 5 (depends on 1)

The system of claim 1, wherein the cloud-based logging service settings module is configured to disable access to the cloud-based logging service by default.

### Claim 6 (depends on 1)

The system of claim 1, wherein the cloud-based logging service settings module is configured to enable access to the cloud-based logging service by default.

### Claim 7 (depends on 1)

The system of claim 1, wherein the processed logs comprise one or more reports, wherein the one or more reports are stored and presented via the interface of the network security gateway appliance.

### Claim 8

A method comprising:
integrating access to a cloud-based logging service within a network security gateway appliance by automatically configuring access settings for the cloud-based logging service and creating an account within the cloud-based logging service by registering the network security gateway appliance itself as a user of the cloud-based logging service in order to allow the network security gateway appliance access to the cloud-based logging service;
creating within the cloud logging service, by the network security gateway appliance, a traffic log or an event log for a network in which the network security gateway appliance resides by making use of the automatically configured access settings and the account;
receiving, by the network security gateway appliance, a request to access data associated with the traffic log or the event log;
responsive to the request and without requiring separate registration with the cloud-based logging service by an administrator of the network security gateway appliance, retrieving, by the network security gateway appliance, the data from the account of the cloud-based logging service and presenting the data to the administrator via a log or report page of an interface of the network security gateway appliance.

### Claim 9 (depends on 8)

The method of claim 8, wherein the cloud-based logging service is invoked by the network security gateway appliance via an application programming interface (API) of the cloud-based logging service, wherein the API is implemented within the network security gateway appliance.

### Claim 10 (depends on 8)

The method of claim 8, wherein the network security gateway appliance is configured to provide and measure an extent of security of the network against network threats, content threats and application-level threats.

### Claim 11 (depends on 10)

The method of claim 10, wherein the network security gateway appliance comprises one or more of a gateway, a network security appliance, an application-level threat detector, a firewall, an Intrusion Prevention System (IPS), an application control, a Virtual Private Network (VPN) appliance and a web content filtering appliance.

### Claim 12 (depends on 8)

The method of claim 8, further comprising when the network security device does not have a local hard disk, enabling the cloud-based logging service for storage of the traffic log or the event log by default within a log settings page of the interface.

### Claim 13 (depends on 12)

The method of claim 12, further comprising when the cloud-based logging service is enabled by default, prompting the administrator to register with the cloud-based logging service to obtain enhanced services.

### Claim 14 (depends on 8)

The method claim 8, further comprising when the network security device includes a local hard disk, disabling the cloud-based logging service for storage of the traffic log or the event log by default within a log setting page of the interface.