How to monitor firewall activity in cWatch Defense Center

A firewall is a security control that monitors and filters website traffic based on predefined rules. It helps administrators gain visibility into incoming requests and identify potentially suspicious activity that may require further review. Within cWatch Defense Center, administrators can monitor firewall activity, review events recorded in the firewall event log, and evaluate how traffic is processed by existing firewall protections.

This article explains how to monitor firewall activity in cWatch Defense Center, review firewall event log data, create and manage custom firewall rules, and understand the available firewall settings. It also provides an overview of key firewall features that can assist administrators in monitoring website security, analyzing traffic activity, and configuring firewall protections according to their organization's requirements.

In this article, we will discuss:

• Monitoring firewall event log and custom rules
• Adding a custom firewall rule
• Updating or removing a custom firewall rule
• Understanding cWatch firewall settings
• Review

Monitoring firewall event log and custom rules

The event log contains the event data used by Defense Center to help administrators monitor firewall activity, verify system events, determine which rule processed a request, identify the reported source of the request, and evaluate whether additional rule configuration should be considered.

1. Log in to your account via https://www.networksolutions.com/my-account/login.
2. Click Security from the left navigation menu.
   
   
    
3. Go to Website Security, then tap Manage for the domain that you would like to access cWatch.
   
   
    
4. Tap Manage Website Security to launch cWatch portal.
   
   
    
5. Ensure that you select the correct domain from the drop-down menu before proceeding to monitor or configure the firewall settings.
   
   
    
6. Go to Defense Center, then click View all.
   
   
    
   Note: Alternatively, click Manage Defense Center from your main dashboard to navigate directly to this section and monitor firewall activity.
7. In the Firewall Event Log section displays the following information:
   
   
    
   • Result: Shows whether the request was blocked or allowed.
   • Traffic IP: Shows the source IP address of the request. This information can help when investigating traffic or creating specific firewall rules.
   • Country: Shows the geographic location associated with the IP address. This information is for reference only and does not confirm a user's identity.
   • Time-stamp: Shows when the event occurred, helping you identify traffic patterns or investigate security incidents.
   • Insight opportunity: Provides recommendations or suggested actions based on the event, when available.

Adding a custom firewall rule

1. Select Derive new rule under Insight Opportunity, then choose Allow or Block to proceed adding a new rule.
   
   
    
2. In the Add new rule window, configure the rule using the following fields:
   
   
    
   1. Condition type: Select the traffic attribute from the drop-down menu that the firewall will evaluate, such as IP, IP range, URL, Header, HTTP Method, or Country.
   2. Condition: Select the comparison operator that will be applied to the selected condition type (for example, Is or Is not).
   3. Value: Enter the value that the firewall will use to evaluate the condition.
   4. Add new condition (optional): Click Add new condition to define additional criteria for the rule.
   5. Action to be taken: Select whether the matching traffic should be Allowed or Blocked.
   6. After completing the rule configuration, click Apply Rule to save and activate the custom firewall rule.
    
   Note:
    

   • Allow and Block rules are configured using the same steps. The selected action determines whether the specified traffic is allowed or blocked.
   • To create a custom rule for high-risk countries, refer to the How to manage traffic from top threat countries in cWatch article for detailed instructions.

Updating or removing a custom firewall rule

1. Go to Defense Center, then select View Custom Firewall Rules under Top Custom Rules.
   
   
    
2. In the Custom Firewall Rules section, perform one of the following actions:
    
   • Click the edit icon next to the custom firewall rule you want to modify, make the necessary changes, and then click Apply Rule to save the updated rule.
     
     
      
   • Click the delete icon next to the custom firewall rule you want to remove, and then click Delete to confirm the action.
     
     
      
     Important: Deleting a custom firewall rule permanently removes it from the firewall configuration. Ensure that the rule is no longer required before proceeding.

Understanding cWatch firewall settings

Review

Using the tools available in cWatch Defense Center, administrators can monitor firewall activity, review traffic events through the firewall event log, and configure custom firewall rules to address specific requirements. Understanding these features and available firewall settings can help support ongoing website security monitoring and firewall management efforts.