topic Re: How to monitor threats for Panorama traffic in General Topics

How to monitor threats for Panorama traffic

Maria-Victoria — Thu, 16 Dec 2021 09:45:21 GMT

Hello,

We can check if a fw is hitting some vulnerability checking the monitor threat tab, I would like to know if there is a way to check the same think for panorama traffic, thanks in advance.

Regards

Re: How to monitor threats for Panorama traffic

PavelK — Thu, 16 Dec 2021 12:01:36 GMT

Thank you for posting question @Maria-Victoria

Panorama does not have any data plane and is not processing any traffic like Firewall does. If you mean checking of the logs from Firewalls, then as long as Firewall is registered in Panorama and sending Threat logs you should be able to see it under: Monitor > Logs > Threat.

If you are referring to something else could you please provide more details what you are looking into?

Kind Regards

Pavel

Re: How to monitor threats for Panorama traffic

Maria-Victoria — Thu, 16 Dec 2021 13:20:25 GMT

Hello,

Pavel, thank you for your answer. What I mean is that, for example if there is a vulnerability "x" I can check in monitor> threat if a fw is suffering an attack due to this vulnerability using the next filter cve eq CVE-number, But If panorama is affected to this vulnerability, how could we perform the same check for panorama?

Re: How to monitor threats for Panorama traffic

PavelK — Thu, 16 Dec 2021 14:32:48 GMT

Thank you for quick reply @Maria-Victoria

Since Panorama does not have any firewall feature and does not process any data plane traffic, there is no equivalent in Panorama what you are used to see in regular Firewall with Threat logs. Panorama can't check itself for vulnerability.

I would recommend to check this security advisory: https://security.paloaltonetworks.com/CVE-2021-44228 based on your PAN-OS version and deployment mode to confirm whether you are affected or not. As time progress Palo Alto is going to provide update on hotfix for PAN-OS versions that are affected.

Kind Regards

Pavel