topic Re: Is it possible to create the custom report each category in spyware? in General Topics

Is it possible to create the custom report each category in spyware?

KiCheon.Lee — Mon, 17 Mar 2014 05:08:04 GMT

Hello

My customer would like to see only CnC threats after the filtering.

So I think to use the filtering for spyware category.

But there are only 'any' and 'unknown' in threat logs.

I want to use the each spyware category such as botnet , backdoor and etc.

How should I do?

Thanks,

KC Lee

Re: Is it possible to create the custom report each category in spyware?

hyadavalli — Tue, 18 Mar 2014 03:35:42 GMT

Hello Lee,

Palo Alto daily generate a report for spyware under 'Monitor->Reports->Threat Reports.

Is this what you are looking for?

Regards,

Hari Yadavalli

Re: Is it possible to create the custom report each category in spyware?

Phoenix — Tue, 18 Mar 2014 14:40:53 GMT

Hello cheon,

From the Threat database selected from the custom reports we can set the filters such that we are looking for type "Spyware" and filter all the spyware threat logs.

The allowed Threat types are flood, scan, spyware, virus, vulnerability.

So if we are looking for anything outside these then we have to go for predefined reports as pointed earlier by hyadavalli where we can find the botnet and other reports.

Thanks

Re: Is it possible to create the custom report each category in spyware?

Retired Member — Tue, 18 Mar 2014 19:06:06 GMT

I don't think this is supported.There is no way to filter categories.

Re: Is it possible to create the custom report each category in spyware?

KiCheon.Lee — Mon, 24 Mar 2014 10:14:49 GMT

Thank you for the answser, hyadavalli , Phoenix and panos.

As panos mentioned, I think so too.

I can not filter each spyware category in threat logs or custom report.

But I have gotten some idea for filtering command and control, recently.

I read the spyware phone home detection value of threat id fields are between 10000 ~ 19999 in the integration syslog document.

So I will make the filtering as below in threat logs.

(threatid geq 10000) and (threatid leq 19999)

How do you think about it?

Do you have any idea better than it?

Thanks,

KC Lee