topic Re: Threat Log filter by 'Name' field in General Topics

Threat Log filter by 'Name' field

CafNetMatt — Sat, 20 Apr 2013 01:17:35 GMT

I've got a potential client that is trying to filter the threat log by the threat 'Name' field. He wants to see all from a specific threat.

Normally you click on the item and it puts it in the filter bar but here when you click on the name you get a pop up with the details on that threat. I've tried a bunch of combinations and can't find anything that will filter on the threat name.

Is there syntax for that field? Another way to filter that traffic?

Thanks.

Matt

Re: Threat Log filter by 'Name' field

emr_1 — Sat, 20 Apr 2013 01:40:41 GMT

You can use Threat ID instead.

If you click threat Name, you can see threat detail.

This window contain threat ID.

You can use this as follow:

(threatid eq xxxxx)

Regards,

Re: Threat Log filter by 'Name' field

UhMayYeah — Sat, 20 Apr 2013 02:40:42 GMT

Agree with emr

You can alternatively just choose the Threat Id from the Available columns in the Threat logs as shown in the Snapshot.

Threats details can also be searched from the Threat Vault.

https://threatvault.paloaltonetworks.com/

Re: Threat Log filter by 'Name' field

CafNetMatt — Sat, 20 Apr 2013 02:47:31 GMT

If I could do two correct answers I would've. I had to choose and being lazy like all good net engineers, I chose the path of least resistance. I added the column. But, both worked and worked perfectly.

Thank you both!

Re: Threat Log filter by 'Name' field

craymond — Wed, 19 Jun 2013 21:37:03 GMT

There should be the capability to filter using text from the Name field also. If you want to search for, let's say, Microsoft vulnerabilities, you should be able to filter using the name field. This would allow an admin to find out what vulnerabilities are trying to be exploited and whether clients or servers have been patched for those vulnerabilities.

Re: Threat Log filter by 'Name' field

cmaier — Fri, 19 Jul 2013 17:10:16 GMT

+1 for the ability to search on threat name and use some sort of wildcard language.