URL category block triggers not logging in Panorama

PA_nts — Wed, 08 Nov 2023 14:50:53 GMT

Hi,

I am testing global protect using Prisma Access - Panorama managed..

On panoroma - i have a mobile user security rule applied with a custom URL filtering profile enabled where I have set the action to block for some of the newer URL categories introduced by PAN in recent times.. ie 'ransomware', 'scanning-activity' and 'command and control'.

The test URL for ransomware is http://urlfiltering.paloaltonetworks.com/test-ransomware

The test URL for Scanning Activity is http://urlfiltering.paloaltonetworks.com/test-scanning-activity

The test URL for command and control is https://urlfiltering.paloaltonetworks.com/test-command-and-control

it works as expected and page is blocked when a mobile user tries to connects to any of these URLs.. however i don't see any log entries under threats/url filtering etc in my panorama logs - i would expect to see something?

if i test a wicar.org malware download.. that is blocked also and i see a threat entry.

am i missing something?

I am running pan-os 11.0.2-h1

thanks in adv

Re: URL category block triggers not logging in Panorama

PA_nts — Thu, 09 Nov 2023 06:46:49 GMT

Ok - please ignore.. it eventually came through in the logs..

we are using cortex data lake and seems some delay in panorama getting the log entries from CDL.

resolved and a panic for nothing :- )

topic Re: URL category block triggers not logging in Panorama in General Topics

URL category block triggers not logging in Panorama

Re: URL category block triggers not logging in Panorama