Question About Categorizing Domains to Suppress Correlated Events

L.Cartooms — Wed, 11 Jun 2025 10:00:33 GMT

Hi all,

We are using Palo Alto firewalls in our network, running PAN-OS 10.2.12-h6.

When navigating to Monitor > Automated Correlation Engine > Correlated Events, we often see entries like the following: “Host repeatedly visited uncategorized domain (20 times), and performed EXE downloads from these domains.”

I would like to flag these domains or IP addresses as safe or categorize them so that I no longer receive alerts for known, trusted domains.

Typically, I categorize domains using the Palo Alto Networks URL filtering - Test A Site page. My question is:
If I categorize a domain through that page, will it affect how these events are generated? Specifically, will the correlated events disappear if the domains are categorized as benign through the URL filtering tool?

Thanks in advance for your help.

Re: Question About Categorizing Domains to Suppress Correlated Events

BPry — Wed, 11 Jun 2025 21:10:39 GMT

@L.Cartooms,

These events are point in time, so the past events would not clear from the logs once the domain is categorized. It would simply suppress the event from being generated again since it's no longer unknown.

topic Re: Question About Categorizing Domains to Suppress Correlated Events in General Topics

Question About Categorizing Domains to Suppress Correlated Events

Re: Question About Categorizing Domains to Suppress Correlated Events