topic Re: How to Check for NTLM traffic in the network in Next-Generation Firewall Discussions https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571831#M2370 <P>Thank you for the suggestion. I was able to search and see the NTLMSSP traffic.</P> Thu, 04 Jan 2024 21:37:14 GMT VishwasAkbilwam 2024-01-04T21:37:14Z How to Check for NTLM traffic in the network https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571797#M2366 <P>Hi,</P> <P>&nbsp;</P> <P>We have Palo Firewalls in our remote offices and data centers. I have been asked to check if NTLM is still being used in our network.</P> <P>Any idea how can we check for the NTLM traffic&nbsp; in firewall traffic logs?</P> <P>&nbsp;</P> <P>Thanks</P> <P>Vishwas</P> Thu, 04 Jan 2024 16:27:11 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571797#M2366 VishwasAkbilwam 2024-01-04T16:27:11Z Re: How to Check for NTLM traffic in the network https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571803#M2367 <P>Check that your security profile logs 92322 events for internal traffic and then filter threat log using&nbsp; ( threatid eq '92322' ).</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Raido_Rattameister_0-1704388189032.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/56269i912CDB0D33F7CCF2/image-size/medium?v=v2&amp;px=400" role="button" title="Raido_Rattameister_0-1704388189032.png" alt="Raido_Rattameister_0-1704388189032.png" /></span></P> <P>&nbsp;</P> Thu, 04 Jan 2024 17:11:47 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571803#M2367 Raido_Rattameister 2024-01-04T17:11:47Z Re: How to Check for NTLM traffic in the network https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571831#M2370 <P>Thank you for the suggestion. I was able to search and see the NTLMSSP traffic.</P> Thu, 04 Jan 2024 21:37:14 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/how-to-check-for-ntlm-traffic-in-the-network/m-p/571831#M2370 VishwasAkbilwam 2024-01-04T21:37:14Z