You are here: Webhelp > Object > Data Security > Network Behavior Record

Network Behavior Record

Network behavior record function audits the IM applications behaviors and record log messages for the access actions, includes:

  • Audits the QQ, WeChat and sinaweibo user behaviors.
  • Log the access behaviors.

Configuring Network Behavior Recording

Configuring network behavior record contains two parts:

  • Create a network behavior record rule
  • Bind a network behavior record rule to a security zone or policy rule

Part 1: Creating a NBR rule

  1. Select Object > Data Security > Network Behavior Record.
  2. Click New.
  3. Click OK.

Part 2: Binding a network behavior record rule to a security zone or security policy rule

The network behavior record configurations are based on security zones or policies.

  • If a security zone is configured with the network behavior record function, the system will perform detection on the traffic that is destined to the binding zone specified in the rule, and then do according to what you specified.
  • If a policy rule is configured with the network behavior record function, the system will perform detection on the traffic that is destined to the policy rule you specified, and then response.
  • The threat protection configurations in a policy rule is superior to that in a zone rule if specified at the same time, and the network behavior record configurations in a destination zone is superior to that in a source zone if specified at the same time.

To realize the zone-based network behavior record:

  1. Create a zone. For more information about how to create, refer to Security Zone.
  2. In the Zone Configuration dialog, select Data Security tab.
  3. Enable the threat protection you need, and select a network behavior record rules from the profile drop-down list below; or you can click Add Profile from the profile drop-down list below, to create a network behavior record rule, see Creating a network behavior record rule.
  4. Click OK to save the settings.

To realize the policy-based network behavior record:

  1. Configure a security policy rule. See Configuring a Security Policy Rule.
  2. In the Data Security tab, select the Enable check box of network behavior record.
  3. From the Profile drop-down list, select a network behavior record rule. You can also click Add Profile to create a new network behavior record rule.
  4. Click OK to save the settings.
  • You can export logs to a designated destination. Refer to Log Configuration
  • By default, a rule will immediately take effect after you click OK to complete configuration

Viewing Logs of Network Behavior Recording

To see the logs of network behavior recording, please refer to the Network Behavior Record Log.