topic Expedition ML rules with any/any in Expedition Discussions

Expedition ML rules with any/any

Bruno_Alipio — Thu, 22 Nov 2018 15:03:03 GMT

After a week of logs from a NGFW I tryed to ML rules from it and got a couple of "suspicious" rules, for example these two below:

In these, as you can see, the source, destination and service are any. What is the threshold that makes Expedition consider an any on the src.ip ou dst.ip? Is there a way to get the full list of destinations?

Thank you.

Re: Expedition ML rules with any/any

alestevez — Tue, 27 Nov 2018 16:14:59 GMT

Hi Bruno, Common Apps are taken in that way, apps like ping, dns that generates tons of logs are considered by ML as a single rule allowed from any to any. If you want to know the sources and destinations then you can apply Rule Enrichment. We do that because those apps can represent the 60% of the total traffic and at the time to analyze you can exclude them if you want meaning we will only consider the 40% of the traffic just for the analisys.