topic Re: PAN NGFW into XDR best practices in Cortex XDR Discussions

PAN NGFW into XDR best practices

PaulThomas00 — Mon, 22 May 2023 21:15:43 GMT

Hi there,

We have have recently started ingesting PAN NGFW logs into XDR, however they're generating a lot of incidents, for now I have excluded - prevented/terminated events, does anyone have any information on best practices, useful ways to use these?

Re: PAN NGFW into XDR best practices

anlynch — Wed, 24 May 2023 01:32:06 GMT

Hi @PaulThomas00,

Thank you for reaching out on LIVEcommunity!

I'm not sure there's a best practices for NGFW logs available. Can you tell me a little more about your issue? I'm assuming the incidents have been investigated and determined to be false positive.

Re: PAN NGFW into XDR best practices

PaulThomas00 — Wed, 24 May 2023 01:39:36 GMT

Thanks for the reply,

It may be the way the FW is configured, but currently all events are being sent to XDR including URL filtering, http traversal, suspicous DNS query, which are all prevented/blocked/terminate/detected, I can see how these events maybe useful in context of an incident, but wondering if there is any benefit from ingesting PAN NGFW events directly into XDR?
The result is an overwhelming number of incidents created. Just wondering the best way to manage these. Any suggestions would be appreciated.