topic Re: Security alerts section empty in AIOps for NGFW Discussions

Security alerts section empty

PRyncevic — Tue, 09 Aug 2022 09:17:47 GMT

Hello, we ran into an issue where the AIOPs page for the firewalls has the security alerts and recommendations missing.

Other sections seem to be OK and displaying health alerts and data, but this one is empty.

On a call a Palo engineer said that this is known to the AIOPs backend team and we need to open a case and have it routed to the backend, but going through a case normally, the support engineers are taking a long time and then in the end sending us to the LiveCommunity website.

Does anyone know how to resolve this and get in touch with the people that can fix this?

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Security alerts section empty

lr — Tue, 09 Aug 2022 16:47:41 GMT

Hello @PRyncevic,

- I need the following data to help you further

1. Please share the screenshot of the alerts tab in the left navigation panel of the summary page.

2. Please let me know that were there any alerts previously present before in the security alerts tab.

3. Please confirm whether the devices are successfully onboarded and sending the data

Note: If you want this information to be confidential you can revert to me back in private.

Regards,
Likith R
Product Specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/bd-p/AIOps_for_NGFW_Discussions
*Don’t forget to accept the solution provided!*

Re: Security alerts section empty

PRyncevic — Tue, 09 Aug 2022 17:15:36 GMT

Hey Likith,

Please find attached the screenshot. It's empty, it was not populated before, but these devices are sending data, I can see health alerts and the adoption pie chart, but the security alert section is empty and does not fill up.

Thank you

Re: Security alerts section empty

svenkatarama — Tue, 09 Aug 2022 19:05:31 GMT

Hi @PRyncevic -

In a Panorama-managed environment, the product looks at the config information from Panorama to create security alerts.

If the Panorama itself is not sending telemetry in this case, please turn on telemetry from Panorama (make sure all 3 checkboxes are on under Settings>Telemetry) and this information should start appearing.

Re: Security alerts section empty

PRyncevic — Wed, 10 Aug 2022 10:16:13 GMT

This is a panorama unmanaged firewall cluster

Re: Security alerts section empty

lr — Wed, 10 Aug 2022 16:08:13 GMT

Hello @PRyncevic,

Could you please share the screenshot of the health alerts page?

Re: Security alerts section empty

PRyncevic — Wed, 10 Aug 2022 16:18:00 GMT

Re: Security alerts section empty

lr — Wed, 10 Aug 2022 19:53:18 GMT

Hello @PRyncevic,

As per the update from the backend team, there are no alerts that have been generated from the firewall and only health alerts are generated.

Also as they are updating the security alerts from the backend the alerts till 10-Aug-2022 will be deleted and the new alerts will be generated from 11-Aug-2022

Please be noted that the alert tab will show the alerts maximum of 90 days and the summary page will show the alerts maximum of 30 days.

Re: Security alerts section empty

PRyncevic — Thu, 11 Aug 2022 08:50:25 GMT

>>> there are no alerts that have been generated from the firewall and only health alerts are generated.

There are definitely security alerts that should be generated as the firewall is absolutely not following every Palo best practice. This was the core of the issue because security alerts should be there.

>> Also as they are updating the security alerts from the backend the alerts till 10-Aug-2022 will be deleted and the new alerts will be generated from 11-Aug-2022

I was informed of this by Palo support as well. Fingers crossed that this works today.

Re: Security alerts section empty

PRyncevic — Thu, 11 Aug 2022 15:23:55 GMT

Looks like the backend people fixed this across the board. Tons of security alerts now

Re: Security alerts section empty

PRyncevic — Mon, 15 Aug 2022 13:29:28 GMT

Well the issue came back in another way. The security alerts appeared, but telemetry stopped. The telemetry completely stopped at around the same time (08/12 ~1AM) across several unrelated environments, firewalls and tenants. _No changes were done to telemetry_.

Please forward this to the AIOPs backend.

Re: Security alerts section empty

lr — Mon, 15 Aug 2022 16:58:14 GMT

Hello @PRyncevic,

Please check whether the telemetry is enabled and sent successfully on all the devices and if there is any error please share the screenshot.

Re: Security alerts section empty

PRyncevic — Mon, 15 Aug 2022 17:03:42 GMT

Telemetry is enabled and successfully sending data according to the devices' telemetry tabs. Since it all stopped at the same time, for unrelated tenants and devices, seems like a backend issue

Re: Security alerts section empty

lr — Mon, 15 Aug 2022 19:08:43 GMT

Hello @PRyncevic,

Please log in to one of the firewalls CLI and execute the below command and attach the screenshot of the same and wait for some time and check whether the telemetry is received in the AIOps instance.
-> request device-telemetry collect-now

Re: Security alerts section empty

PRyncevic — Wed, 17 Aug 2022 09:33:28 GMT

Tried the command yesterday, no luck.

See below, the firewalls are sending successfully, it is arriving on the AIOPs portal but security alerts are not updated. Last update from Aug 11

Re: Security alerts section empty

lr — Fri, 19 Aug 2022 19:28:31 GMT

Hello @PRyncevic,

As per the update from the backend team, The Alerts and its "Last Alert Updated" would not be updated if there is no change in severity.

Re: Security alerts section empty

PRyncevic — Fri, 19 Aug 2022 20:14:23 GMT

Hey Likith, thank you for checking, that makes sense

Could you tell me when are the alerts updated? I applied some changes to remediate some alerts that are active 6 hours ago and they are still active. Do they get updated once per day?

Thanks for your help

Re: Security alerts section empty

lr — Fri, 19 Aug 2022 20:35:32 GMT

Hello @PRyncevic,

Whenever the telemetry is sent from the firewall and gets updated alerts also get updated automatically.