topic Re: Question about Paloalto External Dynamic List in General Topics

Question about Paloalto External Dynamic List

JoHyeonJae — Wed, 19 Oct 2022 08:21:50 GMT

Hello all,

I hope you are doing well : )

I recently received an EDL-related question from a customer, but I couldn't find an answer, so I want to ask for advice.

The customer's configuration is the configuration set by the blacklist IP on the EDL

However, the blacklist IP should be checked in the traffic log, but it can be checked in the treatment log.

Is this expected action?

Then can you tell me why the log is recorded in the Treat log tab?

(EDL)

(Security Policy)

(Treat log)

Thanks!

Re: Question about Paloalto External Dynamic List

OtakarKlier — Wed, 19 Oct 2022 14:41:49 GMT

Hello,

I would suggest they use the 'Unified' log. This shows all the other logs all together. I find its more helpful than jumping from different logs, etc.

Another thing they could try is to put a 'Tag' on the policy that utilizes the EDL. This way they can just filter by the 'Tag'

Regards,

Re: Question about Paloalto External Dynamic List

JoHyeonJae — Thu, 20 Oct 2022 00:08:38 GMT

@OtakarKlier

Thank you for sharing the information.

If so, is it normal work for the IPs set in the EDL to be logged in the Treat log?

Re: Question about Paloalto External Dynamic List

OtakarKlier — Fri, 21 Oct 2022 14:14:35 GMT

Hello,

I honestly do not know, but would be nice if someone who does can chime in @kiwi or @reaper ?

I would only speculate that if the EDL is in a DENY policy, it would show up in the threat logs.

Regards,

Re: Question about Paloalto External Dynamic List

JoHyeonJae — Mon, 24 Oct 2022 00:07:15 GMT

@OtakarKlier
Thank you for replying  .
I have tested EDL in a DENY rule, it is displayed in the Traffic logs.