> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/shield/logs.md). # Logs The log overview provides an overview of all network connections for which a Shield rule has taken effect. {% hint style="danger" %} For values to be shown here, you must enable the **Enginsight Shield (IPS)** option in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policy Manager** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-shield-ips). {% endhint %} {% hint style="info" %} Shield logs are stored for three days by default. To retain them for longer, you can extend the log retention period accordingly. {% endhint %} {% hint style="success" icon="lightbulb" %} For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs) {% endhint %} *** Navigate to **Shield** → **Logs** to show a list of all network connections that were dropped or blocked by a Shield rule. If no Shield rule has taken effect yet, this view is empty. {% hint style="info" %} Permitted network connections that are classified as trusted are not shown here. {% endhint %}

The [log overview](#logs-overview) provides information such as: * which Shield rule took effect and which action it applied. * the source and destination IP addresses of the network connection for which a Shield rule took effect. * whether the network connection involves outbound or inbound network traffic. * which port on which host was affected by the Shield rule. You can also define the [start and end time](#define-start-and-end-time) for the period you want to view and explicitly [allow dropped or blocked network connections](#allowing-network-connections). *** ## Navigation Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly. Click the **Refresh** icon above the list to update all list items. Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages. ### Defining Start and End Time Click **Start Time** or **End Time** in the upper-right corner to define the start or end of the period to be analyzed. The date picker opens. {% tabs %} {% tab title="Relative Time Period" %} Define a **Relative Time Period** manually. You can also select a relative time range from one of the available **Templates**.

Click the field with the default setting **Days Ago** to expand a list of all available time ranges. Select a time range. In the number field, enter the number of seconds, minutes, hours, days, or weeks you want to show. The default value is **1**. Click **Apply** to confirm your settings. {% endtab %} {% tab title="Absolute Time Period" %} Select a date from the calendar view.

Optionally, click **Time** to set an exact time in the 24-hour format using the clock face. First, select an hour. The clock face then switches to the minute view. Select the required minutes. Click **Apply** to confirm your settings. {% endtab %} {% endtabs %} Click **Reset** in the upper-right corner to reset the settings for the selected time range. ### Filtering the List Click the **Filter** icon above the list to filter the list by predefined parameters.

Available Filters

Parameter	Type	Description
Action	String	Filter by whether a network connection was dropped (Drop) or blocked (Reject).
Host	String	Filter by a specific host on which a Shield rule took effect, or exclude it from the results. All available hosts are shown.
Microsegment	String	Filter by a specific microsegment rule that dropped or blocked a network connection, or exclude it from the results. All available microsegment rules are shown.
Source	String	Filter by a specific IP address that is the starting point of a network connection, or exclude it from the results. All available IP addresses are shown.
Rule	String	Filter by a specific manual rule that dropped or blocked a network connection, or exclude it from the results. All available manual rules are shown.
Policy	String	Filter by a specific automatic rule (Autopilot) that dropped or blocked a network connection, or exclude it from the results. All available automatic rules are shown.
Direction	String	Filter by whether a connection involves inbound network traffic (Incoming) or outbound network traffic (Outgoing).
Destination	String	Filter by a specific IP address that is the endpoint of a network connection, or exclude it from the results. All available IP addresses are shown.

### Sorting List Items Click the **Sort** icon next to a column name in the table header to sort by that column in ascending or descending order . Click the sort icon above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority. *** ## Logs: Overview The log overview is structured as a table.

The following information is shown:

Column	Description
Host	Shows the name of the host on which the respective Shield rule took effect. Click a host name to navigate to the respective host detail view.
Action	Shows the action applied to the network connection and the number of times the action was performed in the respective context. The following actions can be shown: Drop: The connection is not permitted, and no response is sent to the source system. Reject: The connection is actively blocked, and a corresponding negative response is sent to the source system.
Direction	Shows the direction of the network traffic. Please note: This column does not contain a value if the direction of data transmission cannot be determined unambiguously. This can occur, for example, with Docker containers that send broadcast packets to all devices on a local network. The following directions can be shown: (Outgoing): Data is sent from within the network to external destinations. (Incoming): Data is sent from outside the network to internal destinations.
Protocol	Shows the transport protocol that is used by the network connection to transmit data packets.
Ports	Shows one or more port numbers through which the respective network connection was established.
Source	Shows the IP address that is the starting point of the respective network connection.
Destination	Shows the IP address that is the endpoint of the respective network connection.
Rules	Shows the manual rules, automatic rules (Autopilots), or microsegment rules that dropped or blocked the respective network connection. Click the name of a rule to navigate to the respective edit view. Automatic rules also include a gray information icon . Hover over it to see which type of network attack was blocked.
Created At	Shows the date and time when the log entry was created.
Actions	Click Allow to allow the respective network connection and classify it as trusted. A new window opens in which you can create a manual rule directly.

*** ## Allowing Network Connections This window is only shown if you click **Allow** at the end of a list item.

After configuring all settings, click **Add Manual Rule** to save and create the new manual Shield rule. Click **Back** to return to the list overview. {% hint style="danger" %} **Please note**: If you leave this view without saving, all configured settings will be lost and cannot be recovered. {% endhint %} ### General Settings Here you can configure various basic settings. The following options are available:

Option	Description
Name	Enter a meaningful name for the rule or keep the predefined name. The default name follows this format: Quick [predefined action] [source IP address].
Action	Select the action that should be enforced for the network connection that triggered the network anomaly. The default action is Allow. Click the Action field to expand a list of all available actions. The following actions are available: Allow: The affected connection is classified as trusted and permitted. A whitelist entry is created for it in the background. Drop: The affected connection is not permitted. No response is sent to the source system. Reject: The affected connection is actively blocked, and a corresponding negative response is sent to the source system. Please note: Rules that permit network connections always override all rules that drop or reject the respective connections.
Protocols	Select one or more transport protocols that further define the network connection to which the action should apply. The default option is All Protocols. Click the Protocols field to expand a list of all available protocols. Select one protocol, multiple protocols, or All Protocols.

Option

Description

Name

Enter a meaningful name for the rule or keep the predefined name.

The default name follows this format: Quick [predefined action] [source IP address].

Action

Select the action that should be enforced for the network connection that triggered the network anomaly.

The default action is Allow.

Click the Action field to expand a list of all available actions.

The following actions are available:

Allow: The affected connection is classified as trusted and permitted. A whitelist entry is created for it in the background.
Drop: The affected connection is not permitted. No response is sent to the source system.
Reject: The affected connection is actively blocked, and a corresponding negative response is sent to the source system.

Please note: Rules that permit network connections always override all rules that drop or reject the respective connections.

Protocols

Select one or more transport protocols that further define the network connection to which the action should apply.

The default option is All Protocols.

Click the Protocols field to expand a list of all available protocols. Select one protocol, multiple protocols, or All Protocols.

### Sources Here you can define the source (IP address range or domain name) of the network connection to which the manual rule should apply. {% hint style="warning" %} **Please note**: If you do not define any sources, the rule always applies to all source IP addresses (IPv4 0.0.0.0/0 and IPv6 ::/0). {% endhint %} The following options are available:

Option	Description
Type	Define whether you want to specify the source using a subnet or a domain name. The default type is CIDR. Click the Type field to expand a list of all available options. The following options are available: CIDR: Define a subnet as the source in Classless Inter-Domain Routing (CIDR) notation. FQDN: Define a Fully Qualified Domain Name (FQDN) as the source.
CIDR	This option is only visible if you selected CIDR in the Type field. The default CIDR is the subnet of the list item selected in the log overview. Enter a subnet in CIDR notation.
FQDN	This option is only visible if you selected FQDN in the Type field. Enter a Fully Qualified Domain Name (FQDN), including all subdomains, for example, hostname.in.domain.

Option

Description

Type

Define whether you want to specify the source using a subnet or a domain name.

The default type is CIDR.

Click the Type field to expand a list of all available options.

The following options are available:

CIDR: Define a subnet as the source in Classless Inter-Domain Routing (CIDR) notation.
FQDN: Define a Fully Qualified Domain Name (FQDN) as the source.

CIDR

This option is only visible if you selected CIDR in the Type field.

The default CIDR is the subnet of the list item selected in the log overview.

Enter a subnet in CIDR notation.

FQDN

This option is only visible if you selected FQDN in the Type field.

Enter a Fully Qualified Domain Name (FQDN), including all subdomains, for example, hostname.in.domain.

Click the **Delete** icon to remove your entries. ### Destinations Here you can define the destination (subnet or domain name) of the network connection to which the manual rule should apply. {% hint style="info" %} The default type is **CIDR**, and the subnet of the destination that is shown in the log overview is already entered in the field. {% endhint %} Configure all settings in the same way as for the [source](#sources). ### Assigned Hosts Here you can define the hosts or groups of hosts to which the manual rule should apply. The following options are available:

Option	Description
Host Binding	Define whether you want to assign hosts to the rule by name or by tag. The default host binding is Reference. Click the Host Binding field to expand a list of all available options. The following options are available: Tags: Select hosts using their assigned tags. Reference: Select hosts by name.
Hosts	This option is only visible if you selected Reference in the Host Binding field. Select the hosts that should be assigned to the manual rule. The default host is the host of the list item that you selected in the log overview. Click the Hosts field to expand a list of all available hosts, and select one or more hosts. Alternatively, use the free-text input to find hosts in the list more quickly. Click the Remove icon next to an added host to remove it from the Hosts field.
Tags	This option is only visible if you selected Tags in the Host Binding field. Select tags for groups of hosts that should be assigned to the manual rule. Click the Tags field to expand a list of all available tags, and select one or more tags. Alternatively, use the free-text input to find tags in the list more quickly. Click the Remove icon next to an added tag to remove it from the Tags field.

Option

Description

Host Binding

Define whether you want to assign hosts to the rule by name or by tag.

The default host binding is Reference.

Click the Host Binding field to expand a list of all available options.

The following options are available:

Tags: Select hosts using their assigned tags.
Reference: Select hosts by name.

Hosts

This option is only visible if you selected Reference in the Host Binding field.

Select the hosts that should be assigned to the manual rule.

The default host is the host of the list item that you selected in the log overview.

Click the Hosts field to expand a list of all available hosts, and select one or more hosts. Alternatively, use the free-text input to find hosts in the list more quickly.

Click the Remove icon next to an added host to remove it from the Hosts field.