Top 20 Outbound IP Report

NathanV — Wed, 25 Sep 2019 14:25:38 GMT

We have a new security director and I have been tasked with created a few reports about IP traffic.

The request for for the following:

-Top 20 outbound IPs that are NOT in the DNS cache

-Top 20 outbound IPs by data sent

-Top 20 outbound IPs by connection time

I have been working on a custom report for this, but I'm having trouble editing out the DNS cached IPs - there doesnt seem to be an option. I really just need a way (if possible) to remove cached entries, and just list IPs

Thanks

Re: Top 20 Outbound IP Report

OtakarKlier — Fri, 04 Oct 2019 18:22:03 GMT

Hello,

I'm not sure you can do this with the PAN. You might need a SIEM for this however if you are referring to the DNS cache of the PAN, you might be out of luck on that. You'll have to get that from the DNS server the PAN is using for lookups.

Regards,

topic Top 20 Outbound IP Report in Advanced Threat Prevention Discussions

Top 20 Outbound IP Report

Re: Top 20 Outbound IP Report