Security Report

ntrabelsi — Mon, 21 Feb 2022 17:46:21 GMT

I would like to create and export a security report giving me a simple count on the number of times an attack was attempted.
The definition of an "attack" could range anywhere from a network discovery to a tentative of password brute-force, as many vectors as possible.
I am using a PA-3020 on version 9.1.9 but the report won't be limited to this version and will be executed on other PAs.

What would be the best way to create such a report?

Thank you!

Re: Security Report

LAYER_8 — Thu, 07 Apr 2022 20:03:06 GMT

Log into the firewall, go to the monitor tab, scroll to the bottom and click manage custom reports, click add, in the top left of the dialog popup, click load template.

Think of a template as a widget, a specific portion of a report.

The filter builder in the bottom will let you exempt or add specificity (maybe your domain controller has a high number of connections you know to be good clogging up the report).

You then go to your report groups menu to take those "widgets" and put them together. Then with email scheduler you can export them, or you are able to click reports at the very bottom of the monitor tab if you aren't exporting them via email you can do it manually.

You are able to repeat this process on each NGFW, coordinate it to all NGFWs with Panorama, or script it using IronSkillet. Many options!

topic Security Report in General Topics

Security Report

Re: Security Report