topic Re: email alert in General Topics

email alert

RobertShawver — Tue, 30 Nov 2021 21:24:02 GMT

Is there anyway to have the palo email me when a rule has been enabled for a certain period of time? If not, is there anyway to do it via API? There has to be a way, yes?

Re: email alert

OtakarKlier — Tue, 30 Nov 2021 23:00:19 GMT

Hello,

While I dont know of any timers, you can setup a custom report to email you policies that have not been hit in say 30/90 days, etc. I'm sure a SIEM policy could be written for this however, depending on your SIEM.

Regards,

Re: email alert

RobertShawver — Wed, 01 Dec 2021 16:23:21 GMT

I can't even get this thing to email a report of user logon failures. I shouldn't be surprised that it can't email me when a rule has been enabled for a certain period of time.

Re: email alert

BPry — Thu, 02 Dec 2021 04:19:19 GMT

@RobertShawver,

The firewall's built-in reporting capabilities are pretty limited. You can get an email for authentication failures, but then it's sent for each authentication failure and not grouped in a report format like your hoping for. Stuff like that is honestly best done (with PAN hardware) through a SIEM like Splunk or the open-source Graylog or something similar.