topic Re: Recommended action for real-time-detection URL category in General Topics

Recommended action for real-time-detection URL category

batd2 — Tue, 09 Aug 2022 10:28:56 GMT

Can you please help me clarify the new real-time-detection category, which is covered by the URL filtering license?

According to the article the Advanced URL filtering "real-time-detection" URL category is not a classification by itself, but a real time inspection, which can return either Benign or as one of the risky category types, e.g. Parked, High Risk, etc.

The logging entry with real-time-detection category is rarely s... - Knowledge Base - Palo Alto Networks

Can you please help me clarify the following:

What is the recommended action real-time-detection in a URL filtering profile?
Will action "alert" permit any traffic detected by the Advanced URL filtering, regardless of the risk and will setting it to block, also block benign traffic?
Do action "allow" disables real time Advanced URL inspection checks?

Re: Recommended action for real-time-detection URL category

BPry — Wed, 10 Aug 2022 02:20:38 GMT

@batd2,

Personally, I have every single category that isn't blocked set to alert. Whatever action you have set, the most restrictive will be the action taken. So if you have real-time-detection set to alert and it's identified as real-time-detection and malware (which you hopefully have set to block) the traffic will be blocked. If you have real-time-detection set to alert and then you get a benign category like social-media that you have set to allow then you would simply alert on the traffic and it would be logged but no action would be taken.

You could alternatively set real-time-detection to allow and the other category identified will always take precedent. If I recall properly this is what the default action for real-time-detection is on the firewall and likely what PAN would recommend since it'll never be the sole detection.

Re: Recommended action for real-time-detection URL category

batd2 — Wed, 10 Aug 2022 07:53:55 GMT

@BPry Thank you for your response. Maybe I am missing the point of having the "real-time-detection" category, since the traffic will be classified as Malware, Phishing, etc. My understanding was that the category is used to control if traffic is being sent to Advanced URL filtering servers. Do you think that the queries are sent to the server for inspection, regardless of the the action for real-time-detection?

Re: Recommended action for real-time-detection URL category

Schneur_Feldman — Fri, 06 Jan 2023 19:00:48 GMT

@BPry That does not make a lot of sense. Does anyone have a good explanation as what action for real-time-detection URL category should be set to?

Re: Recommended action for real-time-detection URL category

Schneur_Feldman — Fri, 06 Jan 2023 19:10:21 GMT

Also I tested it. Seems like Real Time needs to be set to Block.

Re: Recommended action for real-time-detection URL category

TomYoung — Fri, 06 Jan 2023 20:22:44 GMT

Hi @batd2 and @Schneur_Feldman ,

This document says that the real-time-detection category should be set to alert -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/test-url-filtering-configuration (note under Verify Advanced URL Filtering). A-URL will then reclassify the URL and the action will be taken according to the new category. They have URLs to test and see the logs for yourself.
"Alert" will not permit all traffic that matches the category. As explained in the doc, the most severe action will be taken from all the matched categories. "Block" will block all traffic that matches the category because it is the most severe action.
"Allow" does not log. So, it makes sense that it disables real-time checks that match this category. Inline Deep Learning (10.2) https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-new-features/url-filtering-features/cloud-inline-categorization is also part of A-URL. So, I don't think it completely disables A-URL.

Like you, I would like to see this recommendation under the URL BP page -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/url-filtering-best-practices.

Thanks,

Tom

Re: Recommended action for real-time-detection URL category

nikoolayy1 — Sat, 07 Jan 2023 17:45:53 GMT

I suggest watching the https://register.paloaltonetworks.com/nebula-tech-deep-dive-series sessions that will give you some deep dive.